diff options
| author | Masakazu Mokuno <masakazu.mokuno@gmail.com> | 2017-11-10 01:25:50 +0900 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-03-03 15:51:36 +0000 |
| commit | 689ec8ef4af7bc04273bc57f12ecf05b615193ab (patch) | |
| tree | bb4e4b17125d04250608c3f84ebf1413ea47f252 /include | |
| parent | 0585fdec3f51bcdae256ef0c84bdf404b89aa99c (diff) | |
USB: core: Add type-specific length check of BOS descriptors
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream.
As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.
This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.
Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: drop handling of USB_PTM_CAP_TYPE and USB_SSP_CAP_TYPE]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include')
| -rw-r--r-- | include/uapi/linux/usb/ch9.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h index 21c1871c6d23..c3317f460d72 100644 --- a/include/uapi/linux/usb/ch9.h +++ b/include/uapi/linux/usb/ch9.h @@ -819,6 +819,8 @@ struct usb_wireless_cap_descriptor { /* Ultra Wide Band */ __u8 bReserved; } __attribute__((packed)); +#define USB_DT_USB_WIRELESS_CAP_SIZE 11 + /* USB 2.0 Extension descriptor */ #define USB_CAP_TYPE_EXT 2 |