]> git.ipfire.org Git - people/arne_f/kernel.git/commit
USB: check usb_get_extra_descriptor for proper size
authorMathias Payer <mathias.payer@nebelwelt.net>
Wed, 5 Dec 2018 20:19:59 +0000 (21:19 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Dec 2018 08:20:27 +0000 (09:20 +0100)
commitfe26b8d06e965239795bee0a71c9073bed931716
tree33b5b4edc041424923c662a417ec7db24055c84b
parentc037e8873e921758284caf62670c0c059ff5db80
USB: check usb_get_extra_descriptor for proper size

commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.

When reading an extra descriptor, we need to properly check the minimum
and maximum size allowed, to prevent from invalid data being sent by a
device.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/hub.c
drivers/usb/core/usb.c
drivers/usb/host/hwa-hc.c
include/linux/usb.h