diff options
| author | Ingo Molnar <mingo@kernel.org> | 2017-10-24 13:17:20 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2017-10-24 13:17:20 +0200 |
| commit | 9babb091e0ec84f7503fde0a2d9a2a16a0f48e3c (patch) | |
| tree | 9b6f07288b9ca9d8444414cd7da291d7c4731da7 /drivers/usb/core/config.c | |
| parent | 5cdda5117e125e0dbb020425cc55a4c143c6febc (diff) | |
| parent | bb176f67090ca54869fc1262c913aa69d2ede070 (diff) | |
Merge tag 'v4.14-rc6' into locking/core, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/usb/core/config.c')
| -rw-r--r-- | drivers/usb/core/config.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 68b54bd88d1e..883549ee946c 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -960,10 +960,12 @@ int usb_get_bos_descriptor(struct usb_device *dev) for (i = 0; i < num; i++) { buffer += length; cap = (struct usb_dev_cap_header *)buffer; - length = cap->bLength; - if (total_len < length) + if (total_len < sizeof(*cap) || total_len < cap->bLength) { + dev->bos->desc->bNumDeviceCaps = i; break; + } + length = cap->bLength; total_len -= length; if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { |