diff options
| author | Dave Airlie <airlied@redhat.com> | 2017-11-02 12:40:41 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2017-11-02 12:40:41 +1000 |
| commit | 7a88cbd8d65d622c00bd76ba4ae1d893b292c91c (patch) | |
| tree | 826df7ac42ca13c33828d0142046186b91df686b /drivers/usb/core/message.c | |
| parent | 0a4334c9e5405f836c46375c6e279cfdda7da6b5 (diff) | |
| parent | 0b07194bb55ed836c2cc7c22e866b87a14681984 (diff) | |
Backmerge tag 'v4.14-rc7' into drm-next
Linux 4.14-rc7
Requested by Ben Skeggs for nouveau to avoid major conflicts,
and things were getting a bit conflicty already, esp around amdgpu
reverts.
Diffstat (limited to 'drivers/usb/core/message.c')
| -rw-r--r-- | drivers/usb/core/message.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 4c38ea41ae96..371a07d874a3 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, elength = 1; goto next_desc; } + if ((buflen < elength) || (elength < 3)) { + dev_err(&intf->dev, "invalid descriptor buffer length\n"); + break; + } if (buffer[1] != USB_DT_CS_INTERFACE) { dev_err(&intf->dev, "skipping garbage\n"); goto next_desc; |