[PATCH] USB: Gadget RNDIS fix alloc bug. (buffer overflow)

Linux Kernel Mailing List <[email protected]> Mon, 29 May 2006 22:59:01 GMT
Newsgroups gmane.linux.kernel.commits.2-4
Message-ID <[email protected]>
commit 02099adcd5e288be5237d932f5b34296dcebfb3d
tree ccbbd1a72b9794efc338e75ad4e970f792b5fc10
parent efc95599c0261dd7ab3a1d9071024ca140b4c644
author Shaun Tancheff <[email protected]> Thu, 23 Feb 2006 03:47:34 -0400
committer Marcelo Tosatti <[email protected]> Mon, 29 May 2006 00:35:23 -0300

[PATCH] USB: Gadget RNDIS fix alloc bug. (buffer overflow)

Remote NDIS response to OID_GEN_SUPPORTED_LIST only allocated space
for the data attached to the reply, and not the reply structure
itself. This caused other kmalloc'd memory to be corrupted.

Signed-off-by: Shaun Tancheff <[email protected]>
Signed-off-by: David Brownell <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

 drivers/usb/gadget/rndis.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index f265603..785b660 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -853,9 +853,12 @@ static int rndis_query_response (int con
 	
 	/* 
 	 * we need more memory: 
-	 * oid_supported_list is the largest answer 
+	 * gen_ndis_query_resp expects enough space for
+	 * rndis_query_cmplt_type followed by data.
+	 * oid_supported_list is the largest data reply
 	 */
-	r = rndis_add_response (configNr, sizeof (oid_supported_list));
+	r = rndis_add_response (configNr,
+		sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type));
 	
 	if (!r) return -ENOMEM;
 	resp = (rndis_query_cmplt_type *) r->buf;