USB: check usb_get_extra_descriptor for proper size
authorMathias Payer <mathias.payer@nebelwelt.net>
Wed, 5 Dec 2018 20:19:59 +0000 (21:19 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Dec 2018 08:18:51 +0000 (09:18 +0100)
commit7b6e85da8d94948201abb8d576d485892a6a878f
tree48f87f83089996f6ea7daa3bd44e52b1ea281756
parent810487aa9d483262044c41fc1973c7abd95e1d86
USB: check usb_get_extra_descriptor for proper size

commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.

When reading an extra descriptor, we need to properly check the minimum
and maximum size allowed, to prevent from invalid data being sent by a
device.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/hub.c
drivers/usb/core/usb.c
drivers/usb/host/hwa-hc.c
include/linux/usb.h