Re: [PATCH 1/2] usb: gadget: function: rndis: add length check to response query

[Greg Kroah-Hartman]

On Wed, Jul 08, 2026 at 06:24:16PM +0200, Oliver Neukum wrote:
> Hi,
> 
> On 08.07.26 13:08, Griffin Kroah-Hartman wrote:
> > @@ -598,6 +599,13 @@ static int rndis_query_response(struct rndis_params *params,
> >   	if (!params->dev)
> >   		return -ENOTSUPP;
> > +	BufLength = le32_to_cpu(buf->InformationBufferLength);
> > +	BufOffset = le32_to_cpu(buf->InformationBufferOffset);
> > +	if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
> > +	    (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
> > +	    (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
> 
> Wouldn't those last two lines be more efficiently done with:
> 
> BufOffset >= RNDIS_MAX_TOTAL_SIZE - 8

Probably, but doesn't the compiler turn them into the same result?
Also, rndis_set_response() has this same check, so at least everything
is consistent :)

thanks,

greg k-h