summaryrefslogtreecommitdiff
path: root/include/uapi
diff options
context:
space:
mode:
authorMasakazu Mokuno <masakazu.mokuno@gmail.com>2017-11-10 01:25:50 +0900
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-12-09 22:01:56 +0100
commit05ffc7ed55279d659a3e6786e1ffa54eb280a80d (patch)
tree2a05fec6e192c7b9532ad17f5482271727cca3bb /include/uapi
parent34ba2f04a480101c3d60918a45f68ff66973ef49 (diff)
USB: core: Add type-specific length check of BOS descriptors
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream. As most of BOS descriptors are longer in length than their header 'struct usb_dev_cap_header', comparing solely with it is not sufficient to avoid out-of-bounds access to BOS descriptors. This patch adds descriptor type specific length check in usb_get_bos_descriptor() to fix the issue. Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/uapi')
-rw-r--r--include/uapi/linux/usb/ch9.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
index 5e64a86989a5..ab1dadba9923 100644
--- a/include/uapi/linux/usb/ch9.h
+++ b/include/uapi/linux/usb/ch9.h
@@ -854,6 +854,8 @@ struct usb_wireless_cap_descriptor { /* Ultra Wide Band */
__u8 bReserved;
} __attribute__((packed));
+#define USB_DT_USB_WIRELESS_CAP_SIZE 11
+
/* USB 2.0 Extension descriptor */
#define USB_CAP_TYPE_EXT 2
@@ -1046,6 +1048,7 @@ struct usb_ptm_cap_descriptor {
__u8 bDevCapabilityType;
} __attribute__((packed));
+#define USB_DT_USB_PTM_ID_SIZE 3
/*
* The size of the descriptor for the Sublink Speed Attribute Count
* (SSAC) specified in bmAttributes[4:0].