From 6989e89eded433849eb74f4f52d425cd915a8f50 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Mon, 6 Jul 2026 05:01:59 +0800 Subject: [PATCH] drivers/usbdev: rndis: Reject truncated responses When several RNDIS responses are queued, the control request handler sends one complete response if the host wLength is smaller than the whole queue. If the first queued response is also larger than wLength, copying hdr->msglen bytes would overrun the requested transfer and the completion path would consume a partial message. Return EMSGSIZE before copying in that case so the queued response remains intact for a retry with a large enough wLength. Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- drivers/usbdev/rndis.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/usbdev/rndis.c b/drivers/usbdev/rndis.c index 1f2b385a7af..530de30b4d5 100644 --- a/drivers/usbdev/rndis.c +++ b/drivers/usbdev/rndis.c @@ -2615,7 +2615,16 @@ static int usbclass_setup(FAR struct usbdevclass_driver_s *driver, (struct rndis_response_header *)priv->response_queue; ret = priv->response_queue_words * sizeof(uint32_t); if (ret > len) - ret = hdr->msglen; + { + if (hdr->msglen > len) + { + ret = -EMSGSIZE; + break; + } + + ret = hdr->msglen; + } + memcpy(ctrlreq->buf, hdr, ret); ctrlreq->priv = priv; }