summaryrefslogtreecommitdiffstats
path: root/kernel/drivers/usb/usbip/usbip_common.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/drivers/usb/usbip/usbip_common.c')
-rw-r--r--kernel/drivers/usb/usbip/usbip_common.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/kernel/drivers/usb/usbip/usbip_common.c b/kernel/drivers/usb/usbip/usbip_common.c
index facaaf003..e40da7759 100644
--- a/kernel/drivers/usb/usbip/usbip_common.c
+++ b/kernel/drivers/usb/usbip/usbip_common.c
@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
if (!(size > 0))
return 0;
+ if (size > urb->transfer_buffer_length) {
+ /* should not happen, probably malicious packet */
+ if (ud->side == USBIP_STUB) {
+ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+ return 0;
+ } else {
+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+ return -EPIPE;
+ }
+ }
+
ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
if (ret != size) {
dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);