In my scenario(pull that device then plug into another usb port while booting), invalid descriptor accessing happens just like Simon reported. Checking length and ignoring the invalid descriptors works.
References: https://bugzilla.kernel.org/show_bug.cgi?id=83551 Reported-by: Simon Schubert <2+ker...@0x2c.org> Cc: stable <sta...@vger.kernel.org> Signed-off-by: Adam Lee <adam8...@gmail.com> --- drivers/usb/class/cdc-acm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 546a17e8..347c14a 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1155,6 +1155,12 @@ static int acm_probe(struct usb_interface *intf, ac_management_function = buffer[3]; break; case USB_CDC_CALL_MANAGEMENT_TYPE: + if (buffer[0] < 5) { + dev_err(&intf->dev, "Ignoring descriptor with " + "invalid length: type %02x, length %d " + "instead of 5\n", buffer[2], buffer[0]); + goto next_desc; + } call_management_function = buffer[3]; call_interface_num = buffer[4]; break; -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
