From: Vincent Pelletier Date: Tue, 17 Jan 2017 13:20:11 +0000 (+0000) Subject: usb: gadger: f_fs: Do not copy past descriptor end. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=f199a80cfece94b67f9e3d2955666e47c6051517;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git usb: gadger: f_fs: Do not copy past descriptor end. Endpoint descriptors come in 2 sizes, struct usb_endpoint_descriptor being the largest. Use bLength to stop on endpoint descriptor boundary, and not 2 bytes too far. Signed-off-by: Vincent Pelletier Signed-off-by: Felipe Balbi --- diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 5e746adc8a2d..e126897a7fae 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1230,7 +1230,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, desc = epfile->ep->descs[desc_idx]; spin_unlock_irq(&epfile->ffs->eps_lock); - ret = copy_to_user((void *)value, desc, sizeof(*desc)); + ret = copy_to_user((void *)value, desc, desc->bLength); if (ret) ret = -EFAULT; return ret;