diff options
author | Amit Pundir <amit.pundir@linaro.org> | 2017-11-20 21:48:45 +0530 |
---|---|---|
committer | Amit Pundir <amit.pundir@linaro.org> | 2017-11-20 21:48:45 +0530 |
commit | baa6b7f93aec81644160ca02a8a6a5ae3be4ce85 (patch) | |
tree | 2a6bf027912ae74a354ce3b7d460d04ccfac4e55 /drivers/input/misc/ims-pcu.c | |
parent | 7bc703cde6592016ed3eadd8bd592ee9adbe6647 (diff) | |
parent | f409333f361fed0c71c479b2a0c4e032d496cd94 (diff) |
Merge branch 'linux-linaro-lsk-v3.18' into linux-linaro-lsk-v3.18-androidlsk-v3.18-18.03-androidlsk-v3.18-18.02-androidlsk-v3.18-17.11-android
Conflicts:
net/packet/af_packet.c
Fix conflicts by refactoring changes from LTS commit
e4ffdf9ead59 ("packet: hold bind lock when rebinding to fanout hook"),
to align with the changes from AOSP commit 6bec212418d2
("UPSTREAM: packet: fix races in fanout_add()").
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Diffstat (limited to 'drivers/input/misc/ims-pcu.c')
-rw-r--r-- | drivers/input/misc/ims-pcu.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c index f4e8fbec6a94..b5304e264881 100644 --- a/drivers/input/misc/ims-pcu.c +++ b/drivers/input/misc/ims-pcu.c @@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf) return NULL; } - while (buflen > 0) { + while (buflen >= sizeof(*union_desc)) { union_desc = (struct usb_cdc_union_desc *)buf; + if (union_desc->bLength > buflen) { + dev_err(&intf->dev, "Too large descriptor\n"); + return NULL; + } + if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { dev_dbg(&intf->dev, "Found union header\n"); - return union_desc; + + if (union_desc->bLength >= sizeof(*union_desc)) + return union_desc; + + dev_err(&intf->dev, + "Union descriptor to short (%d vs %zd\n)", + union_desc->bLength, sizeof(*union_desc)); + return NULL; } buflen -= union_desc->bLength; |