Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4659a245 authored by Thomas Pugliese's avatar Thomas Pugliese Committed by Greg Kroah-Hartman
Browse files

usb: wusbcore: adjust iterator correctly when searching for ep comp descriptor 



If the endpoint companion descriptor is not the first descriptor in the
extra descriptor buffer of a usb_host_endpoint, the loop in
rpipe_epc_find will get its buffer pointer and remaining size values out
of sync.  The buffer ptr 'itr' is advanced by the descriptor's bLength
field but the remaining size value 'itr_size' is decremented by the
bDescriptorType field which is incorrect.  This patch fixes the loop to
decrement itr_size by bLength as it should.

Signed-off-by: default avatarThomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e500d526

drivers/usb/wusbcore/wa-rpipe.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -298,7 +298,7 @@ static struct usb_wireless_ep_comp_descriptor *rpipe_epc_find( 
			break;

			break;

		}

		}

		itr += hdr->bLength;

		itr += hdr->bLength;

		itr_size -= hdr->bDescriptorType;

		itr_size -= hdr->bLength;

	}

	}

out:

out:

	return epcd;

	return epcd;