diff options
Diffstat (limited to 'drivers/usb/gadget/rndis.c')
| -rw-r--r-- | drivers/usb/gadget/rndis.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index ca41b0b5afb3..48267bc0b2e0 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -1022,22 +1022,29 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length) return r; } -int rndis_rm_hdr(struct sk_buff *skb) +int rndis_rm_hdr(struct gether *port, + struct sk_buff *skb, + struct sk_buff_head *list) { /* tmp points to a struct rndis_packet_msg_type */ __le32 *tmp = (void *) skb->data; /* MessageType, MessageLength */ if (cpu_to_le32(REMOTE_NDIS_PACKET_MSG) - != get_unaligned(tmp++)) + != get_unaligned(tmp++)) { + dev_kfree_skb_any(skb); return -EINVAL; + } tmp++; /* DataOffset, DataLength */ - if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) + if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) { + dev_kfree_skb_any(skb); return -EOVERFLOW; + } skb_trim(skb, get_unaligned_le32(tmp++)); + skb_queue_tail(list, skb); return 0; } |