[PATCH 1/2] usb: gadget: f_tcm: validate CBW length before parsing
Radhey Shyam Pandey <[email protected]>
| Newsgroups | org.kernel.vger.linux-usb,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
bot_submit_command() read the CBW signature before checking the buffer length passed from req->actual. A short host transfer could read past the received buffer. Check US_BULK_CB_WRAP_LEN before accessing CBW fields. Signed-off-by: Radhey Shyam Pandey <[email protected]> --- drivers/usb/gadget/function/f_tcm.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c index b3fa5a17fd2d..565ad1934755 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1525,12 +1525,13 @@ static int bot_submit_command(struct f_uas *fu, struct tcm_usbg_nexus *tv_nexus; u32 cmd_len; - if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) { - pr_err("Wrong signature on CBW\n"); + if (len != US_BULK_CB_WRAP_LEN) { + pr_err("Wrong length for CBW\n"); return -EINVAL; } - if (len != 31) { - pr_err("Wrong length for CBW\n"); + + if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) { + pr_err("Wrong signature on CBW\n"); return -EINVAL; } -- 2.44.4