queue-4.14/usb-core-only-clean-up-what-we-allocated.patch

   1 From 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 Mon Sep 17 00:00:00 2001
   2 From: Andrey Konovalov <andreyknvl@google.com>
   3 Date: Mon, 11 Dec 2017 22:48:41 +0100
   4 Subject: USB: core: only clean up what we allocated
   5
   6 From: Andrey Konovalov <andreyknvl@google.com>
   7
   8 commit 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3 upstream.
   9
  10 When cleaning up the configurations, make sure we only free the number
  11 of configurations and interfaces that we could have allocated.
  12
  13 Reported-by: Andrey Konovalov <andreyknvl@google.com>
  14 Cc: stable <stable@vger.kernel.org>
  15 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
  16 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  17
  18 ---
  19  drivers/usb/core/config.c |    9 ++++++---
  20  1 file changed, 6 insertions(+), 3 deletions(-)
  21
  22 --- a/drivers/usb/core/config.c
  23 +++ b/drivers/usb/core/config.c
  24 @@ -768,18 +768,21 @@ void usb_destroy_configuration(struct us
  25                 return;
  26
  27         if (dev->rawdescriptors) {
  28 -               for (i = 0; i < dev->descriptor.bNumConfigurations; i++)
  29 +               for (i = 0; i < dev->descriptor.bNumConfigurations &&
  30 +                               i < USB_MAXCONFIG; i++)
  31                         kfree(dev->rawdescriptors[i]);
  32
  33                 kfree(dev->rawdescriptors);
  34                 dev->rawdescriptors = NULL;
  35         }
  36
  37 -       for (c = 0; c < dev->descriptor.bNumConfigurations; c++) {
  38 +       for (c = 0; c < dev->descriptor.bNumConfigurations &&
  39 +                       c < USB_MAXCONFIG; c++) {
  40                 struct usb_host_config *cf = &dev->config[c];
  41
  42                 kfree(cf->string);
  43 -               for (i = 0; i < cf->desc.bNumInterfaces; i++) {
  44 +               for (i = 0; i < cf->desc.bNumInterfaces &&
  45 +                               i < USB_MAXINTERFACES; i++) {
  46                         if (cf->intf_cache[i])
  47                                 kref_put(&cf->intf_cache[i]->ref,
  48                                           usb_release_interface_cache);