tree 28d9214930709a3a420523f94f5949e807ed56f5
parent 35de9c774b14163dd935c7605499396e7b56afed
author Mathias Payer <mathias.payer@nebelwelt.net> 1544041199 +0100
committer chrome-bot <chrome-bot@chromium.org> 1545342593 -0800

BACKPORT: USB: check usb_get_extra_descriptor for proper size

commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.

When reading an extra descriptor, we need to properly check the minimum
and maximum size allowed, to prevent from invalid data being sent by a
device.

Reported-by: Hui Peng <benquike@gmail.com>
Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hui Peng <benquike@gmail.com>
Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

BUG=chromium:915636
TEST=CQ

(cherry picked from v3.18.y, commit d672c306e00a904adcbdce42b51b23b3e906f5cf)
Signed-off-by: Guenter Roeck <groeck@chromium.org>

Change-Id: Id4b749680e1af923f23c07017dbf4b00f75b8265
Reviewed-on: https://chromium-review.googlesource.com/1384717
Commit-Ready: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Reviewed-by: Guenter Roeck <groeck@chromium.org>