USB: hub: fix non-SS hub-descriptor handling
authorJohan Hovold <johan@kernel.org>
Wed, 10 May 2017 16:18:28 +0000 (18:18 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 17 May 2017 09:53:02 +0000 (11:53 +0200)
commitbec444cd1c94c48df409a35ad4e5b143c245c3f7
tree0ac8f95b7677441adafef1e513c2d56955e08586
parent2c25a2c818023df64463aac3288a9f969491e507
USB: hub: fix non-SS hub-descriptor handling

Add missing sanity check on the non-SuperSpeed hub-descriptor length in
order to avoid parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes (or a compound-device debug
statement).

Note that we only make sure that the DeviceRemovable field is always
present (and specifically ignore the unused PortPwrCtrlMask field) in
order to continue support any hubs with non-compliant descriptors. As a
further safeguard, the descriptor buffer is also cleared.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org> # 2.6.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/core/hub.c