diff options
| author | Vincent Pelletier <plr.vincent@gmail.com> | 2017-01-17 16:20:11 +0300 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2017-01-24 12:04:23 +0300 |
| commit | f199a80cfece94b67f9e3d2955666e47c6051517 (patch) | |
| tree | a74783987461264c63274010e67d50ceb67e4311 | |
| parent | a98feef743a254fc976a1db8b773a3cd9fec1a30 (diff) | |
| download | linux-f199a80cfece94b67f9e3d2955666e47c6051517.tar.xz | |
usb: gadger: f_fs: Do not copy past descriptor end.
Endpoint descriptors come in 2 sizes, struct usb_endpoint_descriptor being
the largest. Use bLength to stop on endpoint descriptor boundary, and not
2 bytes too far.
Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| -rw-r--r-- | drivers/usb/gadget/function/f_fs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 5e746adc8a2d..e126897a7fae 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1230,7 +1230,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, desc = epfile->ep->descs[desc_idx]; spin_unlock_irq(&epfile->ffs->eps_lock); - ret = copy_to_user((void *)value, desc, sizeof(*desc)); + ret = copy_to_user((void *)value, desc, desc->bLength); if (ret) ret = -EFAULT; return ret; |