USB: misc: cypress_cy7c63: check for short transfer

commit 49cd2f4d747eeb3050b76245a7f72aa99dbd3310 upstream.

As we process the second byte of a control transfer, transfers
of less than 2 bytes must be discarded.

This bug is as old as the driver.

SIgned-off-by: Oliver Neukum <oneukum@suse.com>
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240912125449.1030536-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/misc/cypress_cy7c63.c b/drivers/usb/misc/cypress_cy7c63.c
index cecd7693b7413c10814b8bf2432ebb3db984bcbe..75f5a740cba397c41bbc4b87fb8e18737d00d6a5 100644 (file)
--- a/drivers/usb/misc/cypress_cy7c63.c
+++ b/drivers/usb/misc/cypress_cy7c63.c
@@ -88,6 +88,9 @@ static int vendor_command(struct cypress *dev, unsigned char request,
                                 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
                                 address, data, iobuf, CYPRESS_MAX_REQSIZE,
                                 USB_CTRL_GET_TIMEOUT);
+       /* we must not process garbage */
+       if (retval < 2)
+               goto err_buf;
 
        /* store returned data (more READs to be added) */
        switch (request) {
@@ -107,6 +110,7 @@ static int vendor_command(struct cypress *dev, unsigned char request,
                        break;
        }
 
+err_buf:
        kfree(iobuf);
 error:
        return retval;