From: Sergey Shtylyov Date: Tue, 23 Aug 2022 20:53:26 +0000 (+0300) Subject: usb: gadget: function: rndis: limit # of RNDIS instances to 1000 X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=4348f2e3ab3358898bfe93387ced7f3e1e3a6186;p=linux.git usb: gadget: function: rndis: limit # of RNDIS instances to 1000 As follows from #define NAME_TEMPLATE, the procfs code in the RNDIS driver expects the # of instances to be 3-digit decimal, while the driver calls ida_simple_get() passing 0 as the 'end' argument which results in actual max instance # of INT_MAX. Limit the maximum # of RNDIS instances to 1000 which is still a lot! :-) Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/a8180973-3ded-3644-585a-169589a37642@omp.ru Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 10ba339bcea47..29bf8664bf582 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -869,7 +869,7 @@ EXPORT_SYMBOL_GPL(rndis_msg_parser); static inline int rndis_get_nr(void) { - return ida_simple_get(&rndis_ida, 0, 0, GFP_KERNEL); + return ida_simple_get(&rndis_ida, 0, 1000, GFP_KERNEL); } static inline void rndis_put_nr(int nr)