usb: gadget: function: rndis: limit # of RNDIS instances to 1000
authorSergey Shtylyov <s.shtylyov@omp.ru>
Tue, 23 Aug 2022 20:53:26 +0000 (23:53 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 31 Aug 2022 07:07:52 +0000 (09:07 +0200)
commit4348f2e3ab3358898bfe93387ced7f3e1e3a6186
treeea32f6d5a2bb341083815ddcd07c6feabb6faaac
parent66d1c8021e1d9c97101d58fa09c33c002d96747a
usb: gadget: function: rndis: limit # of RNDIS instances to 1000

As follows from #define NAME_TEMPLATE, the procfs code in the RNDIS driver
expects the # of instances to be 3-digit decimal, while the driver calls
ida_simple_get() passing 0 as the 'end' argument which results in actual
max instance # of INT_MAX.  Limit the maximum # of RNDIS instances to 1000
which is still a lot! :-)

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/a8180973-3ded-3644-585a-169589a37642@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/rndis.c