diff options
| author | Masakazu Mokuno <masakazu.mokuno@gmail.com> | 2017-11-10 01:25:50 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-12-10 13:40:44 +0100 |
| commit | 903b2d14d0e57e48fd80d5a9d35d9fbf3c1e63ea (patch) | |
| tree | 38a4bdc77f91b374cc334d0c990072bd79e2a704 /include/uapi | |
| parent | 4346c775cf707a703e2b305315e37b9beee30bd6 (diff) | |
| download | linux-exynos-903b2d14d0e57e48fd80d5a9d35d9fbf3c1e63ea.tar.gz linux-exynos-903b2d14d0e57e48fd80d5a9d35d9fbf3c1e63ea.tar.bz2 linux-exynos-903b2d14d0e57e48fd80d5a9d35d9fbf3c1e63ea.zip | |
USB: core: Add type-specific length check of BOS descriptors
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream.
As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.
This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.
Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/uapi')
| -rw-r--r-- | include/uapi/linux/usb/ch9.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h index cec06625f407..8512777889b0 100644 --- a/include/uapi/linux/usb/ch9.h +++ b/include/uapi/linux/usb/ch9.h @@ -876,6 +876,8 @@ struct usb_wireless_cap_descriptor { /* Ultra Wide Band */ __u8 bReserved; } __attribute__((packed)); +#define USB_DT_USB_WIRELESS_CAP_SIZE 11 + /* USB 2.0 Extension descriptor */ #define USB_CAP_TYPE_EXT 2 @@ -1068,6 +1070,7 @@ struct usb_ptm_cap_descriptor { __u8 bDevCapabilityType; } __attribute__((packed)); +#define USB_DT_USB_PTM_ID_SIZE 3 /* * The size of the descriptor for the Sublink Speed Attribute Count * (SSAC) specified in bmAttributes[4:0]. |