1 files changed, 6 insertions, 3 deletions

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 55b198ba629b..93b38471754e 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -764,18 +764,21 @@ void usb_destroy_configuration(struct usb_device *dev)
                 return;
 
         if (dev->rawdescriptors) {
-                for (i = 0; i < dev->descriptor.bNumConfigurations; i++)
+                for (i = 0; i < dev->descriptor.bNumConfigurations &&
+                                i < USB_MAXCONFIG; i++)
                         kfree(dev->rawdescriptors[i]);
 
                 kfree(dev->rawdescriptors);
                 dev->rawdescriptors = NULL;
         }
 
-        for (c = 0; c < dev->descriptor.bNumConfigurations; c++) {
+        for (c = 0; c < dev->descriptor.bNumConfigurations &&
+                        c < USB_MAXCONFIG; c++) {
                 struct usb_host_config *cf = &dev->config[c];
 
                 kfree(cf->string);
-                for (i = 0; i < cf->desc.bNumInterfaces; i++) {
+                for (i = 0; i < cf->desc.bNumInterfaces &&
+                                i < USB_MAXINTERFACES; i++) {
                         if (cf->intf_cache[i])
                                 kref_put(&cf->intf_cache[i]->ref,
                                           usb_release_interface_cache);