kevin/linux
1
Fork 0
Code

USB: misc: cypress_cy7c63: check for short transfer

Browse Source 
As we process the second byte of a control transfer, transfers
of less than 2 bytes must be discarded.

This bug is as old as the driver.

SIgned-off-by: Oliver Neukum <oneukum@suse.com>
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240912125449.1030536-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Oliver Neukum 2024-09-12 14:54:43 +02:00 committed by Greg Kroah-Hartman
parent 8265d06b77
commit 49cd2f4d74
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/usb/misc/cypress_cy7c63.c
View File

@ -88,6 +88,9 @@ static int vendor_command(struct cypress *dev, unsigned char request,
USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
address, data, iobuf, CYPRESS_MAX_REQSIZE,
USB_CTRL_GET_TIMEOUT);
/* we must not process garbage */
if (retval < 2)
goto err_buf;
/* store returned data (more READs to be added) */
switch (request) {
@ -107,6 +110,7 @@ static int vendor_command(struct cypress *dev, unsigned char request,
break;
}
err_buf:
kfree(iobuf);
error:
return retval;