Merge tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB fixes for 4.20-rc6

  The "largest" here are some xhci fixes for reported issues. Also here
  is a USB core fix, some quirk additions, and a usb-serial fix which
  required the export of one of the tty layer's functions to prevent
  code duplication. The tty maintainer agreed with this change.

  All of these have been in linux-next with no reported issues"

* tag 'usb-4.20-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  xhci: Prevent U1/U2 link pm states if exit latency is too long
  xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
  USB: check usb_get_extra_descriptor for proper size
  USB: serial: console: fix reported terminal settings
  usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
  USB: Fix invalid-free bug in port_over_current_notify()
  usb: appledisplay: Add 27" Apple Cinema Display

1 files changed, 3 insertions, 3 deletions

diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 79d8bd7a612e..4ebfbd737905 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
  */
 
 int __usb_get_extra_descriptor(char *buffer, unsigned size,
-                               unsigned char type, void **ptr)
+                               unsigned char type, void **ptr, size_t minsize)
 {
         struct usb_descriptor_header *header;
 
         while (size >= sizeof(struct usb_descriptor_header)) {
                 header = (struct usb_descriptor_header *)buffer;
 
-                if (header->bLength < 2) {
+                if (header->bLength < 2 || header->bLength > size) {
                         printk(KERN_ERR
                                 "%s: bogus descriptor, type %d length %d\n",
                                 usbcore_name,
@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
                         return -1;
                 }
 
-                if (header->bDescriptorType == type) {
+                if (header->bDescriptorType == type && header->bLength >= minsize) {
                         *ptr = header;
                         return 0;
                 }