Greg Kroah-Hartman a0e0a58502 USB: fix out-of-bounds in usb_set_configuration ... commit bd7a3fe770 upstream. Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes: It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount. And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller... Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		2017-11-11 13:34:40 +00:00
..
association.h
atmel_usba_udc.h
audio-v2.h
audio.h	ALSA: usb: Fix Processing Unit Descriptor parsers	2013-03-06 03:24:08 +00:00
c67x00.h
cdc.h
ch9.h	USB: fix out-of-bounds in usb_set_configuration	2017-11-11 13:34:40 +00:00
ch11.h	USB: hub: fix SS max number of ports	2017-09-15 18:30:43 +01:00
composite.h
ehci_def.h
functionfs.h
g_hid.h
g_printer.h
gadget.h	usb: gadget: fix typo for default U1/U2 exit latencies	2011-10-13 20:39:59 +03:00
gadgetfs.h
gpio_vbus.h
hcd.h	usb: Fix typo in the definition of Endpoint[out]Request	2017-10-12 15:27:09 +01:00
input.h
intel_mid_otg.h
iowarrior.h
irda.h
isp116x.h
isp1362.h
isp1760.h
Kbuild
langwell_otg.h
langwell_udc.h
m66592.h
midi.h
msm_hsusb_hw.h
msm_hsusb.h
musb.h
net2280.h
otg.h
quirks.h	usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk	2017-07-18 18:38:33 +01:00
r8a66597.h	usb: gadget: r8a66597-udc: add support for SUDMAC	2011-10-13 20:38:39 +03:00
renesas_usbhs.h	usb: gadget: renesas_usbhs: support otg pin control	2011-10-13 20:41:47 +03:00
rndis_host.h
serial.h	USB: serial: add modem-status-change wait queue	2013-04-25 20:22:10 +01:00
sl811.h
storage.h
tmc.h
ulpi.h
usbnet.h	usbnet: fix skb traversing races during unlink(v2)	2012-05-20 22:56:49 +01:00
video.h
wusb-wa.h
wusb.h