[PATCH] USB: Gadget RNDIS fix alloc bug. (buffer overflow)
Linux Kernel Mailing List <[email protected]> Mon, 29 May 2006 22:59:01 GMT
| Newsgroups | gmane.linux.kernel.commits.2-4 |
|---|---|
| Message-ID | <[email protected]> |
commit 02099adcd5e288be5237d932f5b34296dcebfb3d tree ccbbd1a72b9794efc338e75ad4e970f792b5fc10 parent efc95599c0261dd7ab3a1d9071024ca140b4c644 author Shaun Tancheff <[email protected]> Thu, 23 Feb 2006 03:47:34 -0400 committer Marcelo Tosatti <[email protected]> Mon, 29 May 2006 00:35:23 -0300 [PATCH] USB: Gadget RNDIS fix alloc bug. (buffer overflow) Remote NDIS response to OID_GEN_SUPPORTED_LIST only allocated space for the data attached to the reply, and not the reply structure itself. This caused other kmalloc'd memory to be corrupted. Signed-off-by: Shaun Tancheff <[email protected]> Signed-off-by: David Brownell <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> drivers/usb/gadget/rndis.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index f265603..785b660 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -853,9 +853,12 @@ static int rndis_query_response (int con /* * we need more memory: - * oid_supported_list is the largest answer + * gen_ndis_query_resp expects enough space for + * rndis_query_cmplt_type followed by data. + * oid_supported_list is the largest data reply */ - r = rndis_add_response (configNr, sizeof (oid_supported_list)); + r = rndis_add_response (configNr, + sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type)); if (!r) return -ENOMEM; resp = (rndis_query_cmplt_type *) r->buf;