usb: rndis_host: Secure rndis_query check against int overflow

In the Linux kernel, the following vulnerability has been resolved:

usb: rndis_host: Secure rndis_query check against int overflow

Variables off and len typed as uint32 in rndis_query function

are controlled by incoming RNDIS response message thus their

value may be manipulated. Setting off to a unexpectetly large

value will cause the sum with len and 8 to overflow and pass

the implemented validation step. Consequently the response

pointer will be referring to a location past the expected

buffer boundaries allowing information leakage e.g. via

RNDIS_OID_802_3_PERMANENT_ADDRESS OID.