summaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorMathias Payer <mathias.payer@nebelwelt.net>2018-12-05 23:19:59 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-12-05 23:20:14 +0300
commit704620afc70cf47abb9d6a1a57f3825d2bca49cf (patch)
treee8e4e4bcb5003f847518a2ef0669895a6b241eda /include
parent2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 (diff)
downloadlinux-704620afc70cf47abb9d6a1a57f3825d2bca49cf.tar.xz
USB: check usb_get_extra_descriptor for proper size
When reading an extra descriptor, we need to properly check the minimum and maximum size allowed, to prevent from invalid data being sent by a device. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
-rw-r--r--include/linux/usb.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4cdd515a4385..5e49e82c4368 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -407,11 +407,11 @@ struct usb_host_bos {
};
int __usb_get_extra_descriptor(char *buffer, unsigned size,
- unsigned char type, void **ptr);
+ unsigned char type, void **ptr, size_t min);
#define usb_get_extra_descriptor(ifpoint, type, ptr) \
__usb_get_extra_descriptor((ifpoint)->extra, \
(ifpoint)->extralen, \
- type, (void **)ptr)
+ type, (void **)ptr, sizeof(**(ptr)))
/* ----------------------------------------------------------------------- */