USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor

[thirdparty/kernel/stable.git] / drivers / usb / core / config.c

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index cee00dc829b6d69a6b2d584c91940afecc87a67f..52dfe4936a0f3fc857343d9ba5980542c4e346e3 100644 (file)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -897,8 +897,8 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 
        /* Get BOS descriptor */
        ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE);
-       if (ret < USB_DT_BOS_SIZE) {
-               dev_err(ddev, "unable to get BOS descriptor\n");
+       if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) {
+               dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n");
                if (ret >= 0)
                        ret = -ENOMSG;
                kfree(bos);