From bfc6df0fdcac7d263727081ab6f417067d0c7a9d Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Mon, 6 Jul 2026 05:01:59 +0800 Subject: [PATCH] drivers/usbdev: rndis: Reject truncated responses When several RNDIS responses are queued, the control request handler sends one complete response if the host wLength is smaller than the whole queue. If the first queued response is also larger than wLength, copying hdr->msglen bytes would overrun the requested transfer and the completion path would consume a partial message. Return EMSGSIZE before copying in that case so the queued response remains intact for a retry with a large enough wLength. Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- drivers/usbdev/rndis.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/usbdev/rndis.c b/drivers/usbdev/rndis.c index 1f2b385a7af..530de30b4d5 100644 --- a/drivers/usbdev/rndis.c +++ b/drivers/usbdev/rndis.c @@ -2615,7 +2615,16 @@ static int usbclass_setup(FAR struct usbdevclass_driver_s *driver, (struct rndis_response_header *)priv->response_queue; ret = priv->response_queue_words * sizeof(uint32_t); if (ret > len) - ret = hdr->msglen; + { + if (hdr->msglen > len) + { + ret = -EMSGSIZE; + break; + } + + ret = hdr->msglen; + } + memcpy(ctrlreq->buf, hdr, ret); ctrlreq->priv = priv; }