Greg Kroah-Hartman 13713e63bd USB: fix out-of-bounds in usb_set_configuration ... commit bd7a3fe770 upstream. Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes: It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount. And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller... Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-10-12 11:27:33 +02:00
..
audio.h	ALSA: usb: Fix Processing Unit Descriptor parsers	2013-02-21 13:55:12 +01:00
cdc-wdm.h	USB: cdc-wdm: properly include types.h	2014-05-27 16:32:10 -07:00
cdc.h	cdc: add header guards	2015-09-15 21:53:24 -07:00
ch9.h	USB: fix out-of-bounds in usb_set_configuration	2017-10-12 11:27:33 +02:00
ch11.h	USB: hub: fix SS max number of ports	2017-06-26 07:13:09 +02:00
functionfs.h	usb: gadget: ffs: add eventfd notification about ffs events	2015-01-27 09:34:59 -06:00
g_printer.h
gadgetfs.h
Kbuild	usb: cdc-wdm: export cdc-wdm uapi header	2014-05-27 16:29:39 -07:00
midi.h
tmc.h
video.h