diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-03-01 11:04:24 +0300 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-11-05 19:27:00 +0200 |
| commit | 42be8e4cbf13f47f10dbdde8726a4aed9858d8de (patch) | |
| tree | 6f2f1cb6bf43199b4d104282104bd912659483cc /scripts/link-vmlinux.sh | |
| parent | b490a85b59454cb0e57f5c1b7a316304e819e727 (diff) | |
BACKPORT: usb: gadget: rndis: prevent integer overflow in rndis_set_response()
commit 65f3324f4b6fed78b8761c3b74615ecf0ffa81fa upstream.
If "BufOffset" is very large the "BufOffset + 8" operation can have an
integer overflow.
Bug: 239842288
Cc: stable@kernel.org
Fixes: 38ea1eac7d88 ("usb: gadget: rndis: check size of RNDIS_MSG_SET command")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220301080424.GA17208@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4dcecb9ada2680a4211e5ccc9b27de2df964e404
Diffstat (limited to 'scripts/link-vmlinux.sh')
0 files changed, 0 insertions, 0 deletions