diff options
| author | Jason Gunthorpe <jgg@mellanox.com> | 2018-12-11 14:24:57 -0700 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-12-11 14:24:57 -0700 |
| commit | 28ab1bb0e8f031dd7dd3462ff8f6b2e93fc77e7f (patch) | |
| tree | 3c0d2177d9bfc513c2d06c1efb5ab62c74fd1953 /drivers/usb/core/usb.c | |
| parent | b874155a5fa450bf5e4b5303cbfff05958805bf8 (diff) | |
| parent | 40e020c129cfc991e8ab4736d2665351ffd1468d (diff) | |
Merge tag 'v4.20-rc6' into rdma.git for-next
For dependencies in following patches.
Diffstat (limited to 'drivers/usb/core/usb.c')
| -rw-r--r-- | drivers/usb/core/usb.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 79d8bd7a612e..4ebfbd737905 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number); */ int __usb_get_extra_descriptor(char *buffer, unsigned size, - unsigned char type, void **ptr) + unsigned char type, void **ptr, size_t minsize) { struct usb_descriptor_header *header; while (size >= sizeof(struct usb_descriptor_header)) { header = (struct usb_descriptor_header *)buffer; - if (header->bLength < 2) { + if (header->bLength < 2 || header->bLength > size) { printk(KERN_ERR "%s: bogus descriptor, type %d length %d\n", usbcore_name, @@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size, return -1; } - if (header->bDescriptorType == type) { + if (header->bDescriptorType == type && header->bLength >= minsize) { *ptr = header; return 0; } |