diff options
| author | Ingo Molnar <mingo@kernel.org> | 2018-12-17 17:46:26 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2018-12-17 17:46:26 +0100 |
| commit | 76aea1eeb98d2d75d9297fda777efeffe3657aeb (patch) | |
| tree | 18fdf94ec846b553f1e60438279a3b449897189b /drivers/usb/core/usb.c | |
| parent | 43b9e4febc66b98d83cc1560196d56ac7fef3c32 (diff) | |
| parent | 7566ec393f4161572ba6f11ad5171fd5d59b0fbd (diff) | |
| download | linux-76aea1eeb98d2d75d9297fda777efeffe3657aeb.tar.bz2 | |
Merge tag 'v4.20-rc7' into perf/core, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/usb/core/usb.c')
| -rw-r--r-- | drivers/usb/core/usb.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 79d8bd7a612e..4ebfbd737905 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number); */ int __usb_get_extra_descriptor(char *buffer, unsigned size, - unsigned char type, void **ptr) + unsigned char type, void **ptr, size_t minsize) { struct usb_descriptor_header *header; while (size >= sizeof(struct usb_descriptor_header)) { header = (struct usb_descriptor_header *)buffer; - if (header->bLength < 2) { + if (header->bLength < 2 || header->bLength > size) { printk(KERN_ERR "%s: bogus descriptor, type %d length %d\n", usbcore_name, @@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size, return -1; } - if (header->bDescriptorType == type) { + if (header->bDescriptorType == type && header->bLength >= minsize) { *ptr = header; return 0; } |