X-Git-Url: https://gerrit.opnfv.org/gerrit/gitweb?a=blobdiff_plain;ds=sidebyside;f=kernel%2Fdrivers%2Fusb%2Fusbip%2Fusbip_common.c;h=e40da7759a0e6cd3a55bccdf90bb10284376ab11;hb=52f993b8e89487ec9ee15a7fb4979e0f09a45b27;hp=facaaf003f19931b2f15603568bb565f3de40607;hpb=c189ccac5702322ed843fe17057035b7222a59b6;p=kvmfornfv.git

diff --git a/kernel/drivers/usb/usbip/usbip_common.c b/kernel/drivers/usb/usbip/usbip_common.c
index facaaf003..e40da7759 100644
--- a/kernel/drivers/usb/usbip/usbip_common.c
+++ b/kernel/drivers/usb/usbip/usbip_common.c
@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
 	if (!(size > 0))
 		return 0;
 
+	if (size > urb->transfer_buffer_length) {
+		/* should not happen, probably malicious packet */
+		if (ud->side == USBIP_STUB) {
+			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+			return 0;
+		} else {
+			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+			return -EPIPE;
+		}
+	}
+
 	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
 	if (ret != size) {
 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);