Re: [PATCH v2] usb: gadget: rndis: validate query and set message buffers

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Apr 01, 2026 at 07:34:10PM +0800, Pengpeng Hou wrote:
> Hi Greg,
> 
> I have not tested this against an actual RNDIS host/device setup yet.
> 
> For clarity, v2 did not change the code from v1; it only expanded the
> commit message.
> 
> What I was trying to fix here is limited to two current-tree checks that
> are missing today:
> 
> 1. rndis_msg_parser() reads MsgLength from the request body but does not
>    verify that it fits within the actual EP0 request buffer length.

Yes, that's a good thing to check :)

> 2. rndis_set_response() validates the host-controlled
>    InformationBufferOffset/InformationBufferLength pair before using it,
>    but rndis_query_response() still passes the same fields directly into
>    gen_ndis_query_resp() without corresponding bounds validation.

Ah, so that should be fixed up.

> I do not mean this patch to claim that these are the only issues in the
> RNDIS parser.

Oh, I did not think that, there are loads of issues with RNDIS that are
not covered by this patch :)

> If you want runtime testing before considering this further, I can stop
> here until I can test it properly.

Yes, please test this so that we know it doesn't break existing systems.

thanks,

greg k-h