usb: gadget: f_mtp: Return error if count is negative

If the user passes in a negative file size in a int64,
this will compare to be smaller than buffer length,
and it will get truncated to form a read length that
is larger than the buffer length.

To fix, return -EINVAL if the count argument is negative,
so the loop will never happen.

Mot-CRs-fixed: (CR)
CVE-fixed: CVE-2017-13163
Bug: 37429972

Test: Test with PoC
Change-Id: I5Montanae38e6fbe2c17eb8c493f9eb81df6cfd780a4
Signed-off-by: Jerry Zhang <zhangjerry@google.com>
Signed-off-by: Amarendra Reddy <amarenr@motorola.com>
Reviewed-on: https://gerrit.mot.com/1090092
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Igor Kovalenko <igork@motorola.com>
Submit-Approved: Jira Key
Reviewed-on: https://gerrit.mot.com/1167331
Reviewed-by: Jianqi Yang <yangj@motorola.com>
Reviewed-on: https://gerrit.mot.com/1262843
Reviewed-on: https://gerrit.mot.com/1338862
Reviewed-by: Huosheng Liao <liaohs@motorola.com>
Reviewed-on: https://gerrit.mot.com/1449108
Reviewed-on: https://gerrit.mot.com/1511638
Reviewed-by: Zonghua Liu <a17671@motorola.com>

drivers/usb/gadget/function/f_mtp.c

@@ -812,6 +812,11 @@ static void send_file_work(struct work_struct *data)
 	offset = dev->xfer_file_offset;
 	count = dev->xfer_file_length;
 
+	if (count < 0) {
+		dev->xfer_result = -EINVAL;
+		return;
+	}
+
 	mtp_log("(%lld %lld)\n", offset, count);
 
 	if (dev->xfer_send_header) {
@@ -926,6 +931,11 @@ static void receive_file_work(struct work_struct *data)
 	offset = dev->xfer_file_offset;
 	count = dev->xfer_file_length;
 
+	if (count < 0) {
+		dev->xfer_result = -EINVAL;
+		return;
+	}
+
 	mtp_log("(%lld)\n", count);
 	if (!IS_ALIGNED(count, dev->ep_out->maxpacket))
 		mtp_log("- count(%lld) not multiple of mtu(%d)\n",