aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorHans de Goede <hdegoede@redhat.com>2013-08-03 16:37:48 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-09-26 17:18:12 -0700
commitef7198be2830f7d6951512724203326746756a86 (patch)
tree3cd4d974a96b891173ce4a0ef37d7263a6ceba87 /drivers/usb
parent94cc662c4bd9f8487d54262bbfc2307d9b1fc6b1 (diff)
usb: config->desc.bLength may not exceed amount of data returned by the device
commit b4f17a488ae2e09bfcf95c0e0b4219c246f1116a upstream. While reading the config parsing code I noticed this check is missing, without this check config->desc.wTotalLength can end up with a value larger then the dev->rawdescriptors length for the config, and when userspace then tries to get the rawdescriptors bad things may happen. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/core/config.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 7199adccf44..a6b2cabe793 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
if (config->desc.bDescriptorType != USB_DT_CONFIG ||
- config->desc.bLength < USB_DT_CONFIG_SIZE) {
+ config->desc.bLength < USB_DT_CONFIG_SIZE ||
+ config->desc.bLength > size) {
dev_err(ddev, "invalid descriptor for config index %d: "
"type = 0x%X, length = %d\n", cfgidx,
config->desc.bDescriptorType, config->desc.bLength);