USB: wusb: correctly check size of security descriptor.
Reported-by: Roel Kluin <roel.kluin@gmail.com> Signed-off-by: David Vrabel <david.vrabel@csr.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
committed by
Greg Kroah-Hartman
parent
2e9729d0f8
commit
9279095a9e
@@ -205,15 +205,15 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc,
|
|||||||
const void *itr, *top;
|
const void *itr, *top;
|
||||||
char buf[64];
|
char buf[64];
|
||||||
|
|
||||||
secd = kmalloc(sizeof(struct usb_security_descriptor), GFP_KERNEL);
|
secd = kmalloc(sizeof(*secd), GFP_KERNEL);
|
||||||
if (secd == NULL) {
|
if (secd == NULL) {
|
||||||
result = -ENOMEM;
|
result = -ENOMEM;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
|
result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
|
||||||
0, secd, sizeof(struct usb_security_descriptor));
|
0, secd, sizeof(*secd));
|
||||||
if (result < sizeof(secd)) {
|
if (result < sizeof(*secd)) {
|
||||||
dev_err(dev, "Can't read security descriptor or "
|
dev_err(dev, "Can't read security descriptor or "
|
||||||
"not enough data: %d\n", result);
|
"not enough data: %d\n", result);
|
||||||
goto out;
|
goto out;
|
||||||
|
Reference in New Issue
Block a user