diff options
| author | David S. Miller <davem@davemloft.net> | 2017-10-30 14:10:01 +0900 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-10-30 21:09:24 +0900 |
| commit | e1ea2f9856b765a2eaabb403a6751f70efc9ba4c (patch) | |
| tree | 771f0f96fdab1b27757730e96d911c73f5499ee4 /drivers/usb/core/config.c | |
| parent | aad93c70b9a3b80dbc383a31e77a119f69bdd856 (diff) | |
| parent | 0b07194bb55ed836c2cc7c22e866b87a14681984 (diff) | |
| download | linux-e1ea2f9856b765a2eaabb403a6751f70efc9ba4c.tar.bz2 | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Several conflicts here.
NFP driver bug fix adding nfp_netdev_is_nfp_repr() check to
nfp_fl_output() needed some adjustments because the code block is in
an else block now.
Parallel additions to net/pkt_cls.h and net/sch_generic.h
A bug fix in __tcp_retransmit_skb() conflicted with some of
the rbtree changes in net-next.
The tc action RCU callback fixes in 'net' had some overlap with some
of the recent tcf_block reworking.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/usb/core/config.c')
| -rw-r--r-- | drivers/usb/core/config.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 68b54bd88d1e..883549ee946c 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -960,10 +960,12 @@ int usb_get_bos_descriptor(struct usb_device *dev) for (i = 0; i < num; i++) { buffer += length; cap = (struct usb_dev_cap_header *)buffer; - length = cap->bLength; - if (total_len < length) + if (total_len < sizeof(*cap) || total_len < cap->bLength) { + dev->bos->desc->bNumDeviceCaps = i; break; + } + length = cap->bLength; total_len -= length; if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { |