]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
USB: Fix descriptor count when handling invalid MBIM extended descriptor
authorSeungjin Bae <eeodqql09@gmail.com>
Sun, 28 Sep 2025 18:56:11 +0000 (14:56 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 13 Oct 2025 07:34:16 +0000 (09:34 +0200)
commit5570ad1423ee60f6e972dadb63fb2e5f90a54cbe
treebf113980773664a10c1afa757d84e1437cb66ca4
parent1c97fc901fb6318aca0160da96736d0bc136ddcd
USB: Fix descriptor count when handling invalid MBIM extended descriptor

In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE
descriptor was using 'break' upon detecting an invalid length.

This was incorrect because 'break' only exits the switch statement,
causing the code to fall through to cnt++, thus incorrectly
incrementing the count of parsed descriptors for a descriptor that was
actually invalid and being discarded.

This patch changes 'break' to 'goto next_desc;' to ensure that the
logic skips the counter increment and correctly proceeds to the next
descriptor in the buffer. This maintains an accurate count of only
the successfully parsed descriptors.

Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20250928185611.764589-1-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/message.c