Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2588736c authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "USB: fix out-of-bounds in usb_set_configuration"

parents b26721cb 115800aa

drivers/usb/core/config.c

+11 −3
Original line number Diff line number Diff line
@@ -520,15 +520,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, 


		} else if (header->bDescriptorType ==

				USB_DT_INTERFACE_ASSOCIATION) {

			struct usb_interface_assoc_descriptor *d;



			d = (struct usb_interface_assoc_descriptor *)header;

			if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {

				dev_warn(ddev,

					 "config %d has an invalid interface association descriptor of length %d, skipping\n",

					 cfgno, d->bLength);

				continue;

			}



			if (iad_num == USB_MAXIADS) {

				dev_warn(ddev, "found more Interface "

					       "Association Descriptors "

					       "than allocated for in "

					       "configuration %d\n", cfgno);

			} else {

				config->intf_assoc[iad_num] =

					(struct usb_interface_assoc_descriptor

					*)header;

				config->intf_assoc[iad_num] = d;

				iad_num++;

			}

include/uapi/linux/usb/ch9.h

+1 −0
Original line number Diff line number Diff line
@@ -705,6 +705,7 @@ struct usb_interface_assoc_descriptor { 
	__u8  iFunction;

} __attribute__ ((packed));



#define USB_DT_INTERFACE_ASSOCIATION_SIZE	8



/*-------------------------------------------------------------------------*/