[PATCH 1/2] usb: gadget: f_tcm: validate CBW length before parsing

[Radhey Shyam Pandey]

bot_submit_command() read the CBW signature before checking the buffer
length passed from req->actual. A short host transfer could read past
the received buffer.

Check US_BULK_CB_WRAP_LEN before accessing CBW fields.

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xxxxxxx>
---
 drivers/usb/gadget/function/f_tcm.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index b3fa5a17fd2d..565ad1934755 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1525,12 +1525,13 @@ static int bot_submit_command(struct f_uas *fu,
 	struct tcm_usbg_nexus *tv_nexus;
 	u32 cmd_len;
 
-	if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
-		pr_err("Wrong signature on CBW\n");
+	if (len != US_BULK_CB_WRAP_LEN) {
+		pr_err("Wrong length for CBW\n");
 		return -EINVAL;
 	}
-	if (len != 31) {
-		pr_err("Wrong length for CBW\n");
+
+	if (cbw->Signature != cpu_to_le32(US_BULK_CB_SIGN)) {
+		pr_err("Wrong signature on CBW\n");
 		return -EINVAL;
 	}
 
-- 
2.44.4