aboutsummaryrefslogtreecommitdiff
path: root/drivers/usb/core/config.c
diff options
context:
space:
mode:
authordoc HD <doc.divxm@gmail.com>2018-03-07 10:05:53 +0300
committerdoc HD <doc.divxm@gmail.com>2018-03-07 10:05:53 +0300
commit812962bfbf833dc214abda0dea8339d02bff3cd1 (patch)
tree7384e312916e52a56610d321022d534251c0b0d4 /drivers/usb/core/config.c
parent9faca91a45aca9b575f4bbee4ce2ce1681f4ce8f (diff)
parent0de87126892e03146cf68b204056c48c45aec7a6 (diff)
Merge branch 'android-msm-marlin-3.18-oreo-mr1' of https://android.googlesource.com/kernel/msm into o8.1o8.1
Change-Id: I91a8b8fc5803aacafb3eb5e6cf35cfa1213ed3e4
Diffstat (limited to 'drivers/usb/core/config.c')
-rw-r--r--drivers/usb/core/config.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 1fb6303b918..2ecf6360171 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -536,15 +536,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
} else if (header->bDescriptorType ==
USB_DT_INTERFACE_ASSOCIATION) {
+ struct usb_interface_assoc_descriptor *d;
+
+ d = (struct usb_interface_assoc_descriptor *)header;
+ if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+ dev_warn(ddev,
+ "config %d has an invalid interface association descriptor of length %d, skipping\n",
+ cfgno, d->bLength);
+ continue;
+ }
+
if (iad_num == USB_MAXIADS) {
dev_warn(ddev, "found more Interface "
"Association Descriptors "
"than allocated for in "
"configuration %d\n", cfgno);
} else {
- config->intf_assoc[iad_num] =
- (struct usb_interface_assoc_descriptor
- *)header;
+ config->intf_assoc[iad_num] = d;
iad_num++;
}