summaryrefslogtreecommitdiff
path: root/drivers/usb/gadget/rndis.c
diff options
context:
space:
mode:
authorShaun Tancheff <shaun@tancheff.com>2006-02-22 19:47:19 -0800
committerGreg Kroah-Hartman <gregkh@suse.de>2006-02-28 12:42:06 -0800
commit8763716bfe4d8a16bef28c9947cf9d799b1796a5 (patch)
treef0e8d0dcbf55953ea084f110c013743716b2a068 /drivers/usb/gadget/rndis.c
parentd5ec33490c67affef93aebf76e1238260c82d377 (diff)
[PATCH] USB: Gadget RNDIS fix alloc bug. (buffer overflow)
Remote NDIS response to OID_GEN_SUPPORTED_LIST only allocated space for the data attached to the reply, and not the reply structure itself. This caused other kmalloc'd memory to be corrupted. Signed-off-by: Shaun Tancheff <shaun@tancheff.com> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/gadget/rndis.c')
-rw-r--r--drivers/usb/gadget/rndis.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 9689efeb364c..6d6eaad73968 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -853,11 +853,14 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
// DEBUG("%s: OID = %08X\n", __FUNCTION__, cpu_to_le32(buf->OID));
if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
- /*
- * we need more memory:
- * oid_supported_list is the largest answer
+ /*
+ * we need more memory:
+ * gen_ndis_query_resp expects enough space for
+ * rndis_query_cmplt_type followed by data.
+ * oid_supported_list is the largest data reply
*/
- r = rndis_add_response (configNr, sizeof (oid_supported_list));
+ r = rndis_add_response (configNr,
+ sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_query_cmplt_type *) r->buf;