summaryrefslogtreecommitdiffstats
path: root/include/linux/usb.h
diff options
context:
space:
mode:
authorMathias Payer <mathias.payer@nebelwelt.net>2018-12-05 21:19:59 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-12-05 21:20:14 +0100
commit704620afc70cf47abb9d6a1a57f3825d2bca49cf (patch)
treee8e4e4bcb5003f847518a2ef0669895a6b241eda /include/linux/usb.h
parent2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 (diff)
downloadlinux-704620afc70cf47abb9d6a1a57f3825d2bca49cf.tar.gz
linux-704620afc70cf47abb9d6a1a57f3825d2bca49cf.tar.bz2
linux-704620afc70cf47abb9d6a1a57f3825d2bca49cf.zip
USB: check usb_get_extra_descriptor for proper size
When reading an extra descriptor, we need to properly check the minimum and maximum size allowed, to prevent from invalid data being sent by a device. Reported-by: Hui Peng <benquike@gmail.com> Reported-by: Mathias Payer <mathias.payer@nebelwelt.net> Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Hui Peng <benquike@gmail.com> Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux/usb.h')
-rw-r--r--include/linux/usb.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4cdd515a4385..5e49e82c4368 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -407,11 +407,11 @@ struct usb_host_bos {
};
int __usb_get_extra_descriptor(char *buffer, unsigned size,
- unsigned char type, void **ptr);
+ unsigned char type, void **ptr, size_t min);
#define usb_get_extra_descriptor(ifpoint, type, ptr) \
__usb_get_extra_descriptor((ifpoint)->extra, \
(ifpoint)->extralen, \
- type, (void **)ptr)
+ type, (void **)ptr, sizeof(**(ptr)))
/* ----------------------------------------------------------------------- */