tree ac792fd380936041035c1fa232a40bf9aad40133
parent e4ede90e3ebbff4ad6bf84488844e6e8938f3984
author Mathias Payer <mathias.payer@nebelwelt.net> 1544041199 +0100
committer chrmhoffmann <chrmhoffmann@gmail.com> 1586074506 +0200

USB: check usb_get_extra_descriptor for proper size

commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.

When reading an extra descriptor, we need to properly check the minimum
and maximum size allowed, to prevent from invalid data being sent by a
device.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2018-20169
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

Change-Id: I58b9bd1e61a9dd722d99ed05f86f75bd0eb525b4