From patchwork Fri Mar 22 15:44:16 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 160939 Delivered-To: patch@linaro.org Received: by 2002:a02:c6d8:0:0:0:0:0 with SMTP id r24csp964300jan; Fri, 22 Mar 2019 08:50:24 -0700 (PDT) X-Google-Smtp-Source: APXvYqzepzI9OrUVUAzCzaYrve3wUjSK9TP3TiACuYrPttRbiltZC/Y1+uChK1MfrClzKc2hajfh X-Received: by 2002:a65:4342:: with SMTP id k2mr9717579pgq.445.1553269824456; Fri, 22 Mar 2019 08:50:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553269824; cv=none; d=google.com; s=arc-20160816; b=ePtUC8f/KL1nCtHty4BtZXClbqjU9Zh6cA7xiYCXq4jnAafmJ1FwO6HcxHsrb5gkF4 XdswAKogN7y1PcU2EAR3k8zVAaKhOkbYkYps9fa3mbvFOn8QQuK+nJdRQK7uW9unomco 8NjSCMUvp0kiF+K2RXLAYgWrAEos5pvumg08sovnijUzMJ7YwntYtmyBQX86tMoVhv6K O7HJuF2XtMSCQyTRcfQ/VzqqvWH7cQ8QTYg2TMoTJWY/E8j303vTGeUfrYOAvaiB4Oia 6ZrFACbWyOXNtCqcIWQEdfjb+pU15x4utttFDSxGYaWQ2DZNlISltlwTcbbvGBLPDKv1 oMaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=u03V/k9CCib2fY1K/DbNm63eicf3FNTMCG4j640J+y0=; b=SMFF2RWhutA63Hwv0RmbYHkIY1fmvcwcLd9twh1R/ZDEU6q4hFVrOZjll+AfPqbyR0 MXk2uuOzfm1RiMQRyCezamQ5xa1fLNC8Q7NaFUSkd2ZVUcYvfslTCxQgMRltYkHayOk0 bzyBPX3K3VfqTxNoEE6a/veoshmH2fDZsbW5TlHeTkd2StS3ICiQiqDBlsE4iDLWHAld u/O7x6bGd9XxQrlLjwLq0rZ9zOKW1R+fkqXYSmANxajpHSrCg0cW2YOX7OvX4x0Yfxce DG0OmZdG8qGILpJNSY91IuPrG4Mam7blddLrw9hv+jyiahtc4EMz2hoPeSv9IHlbD/Se lq7g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c22si7093101pgj.405.2019.03.22.08.50.24; Fri, 22 Mar 2019 08:50:24 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728129AbfCVPuS (ORCPT + 31 others); Fri, 22 Mar 2019 11:50:18 -0400 Received: from mout.kundenserver.de ([212.227.17.24]:40055 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727696AbfCVPuR (ORCPT ); Fri, 22 Mar 2019 11:50:17 -0400 Received: from wuerfel.lan ([149.172.19.189]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.145]) with ESMTPA (Nemesis) id 1N8XLj-1gu9844C3d-014W3f; Fri, 22 Mar 2019 16:50:02 +0100 From: Arnd Bergmann To: stable@vger.kernel.org, Greg Kroah-Hartman , Alan Stern , Suwan Kim , "Gustavo A. R. Silva" Cc: Andrey Konovalov , Arnd Bergmann , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BACKPORT 4.4.y 25/25] USB: core: only clean up what we allocated Date: Fri, 22 Mar 2019 16:44:16 +0100 Message-Id: <20190322154425.3852517-26-arnd@arndb.de> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20190322154425.3852517-1-arnd@arndb.de> References: <20190322154425.3852517-1-arnd@arndb.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:wMbSPcHeSmT84A30VtzrJGakHf9ZFJmOTa7BcDHtx3x+ETBZjeh g1H/1BcB1LCrojY2Jz+mQUWSKoezbqp0L5g+iL2aDa/1oYctHJsCCJTDKta7kganqTUCiGT WbKhG6iBsGx1g/hvksxHEEYIHbL42951pU922HTHUGc825K3zatuFLlhqb1fV0TgtqHMmz0 C55FXJMdjpfPIcCx2UNvg== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1; V03:K0:lwFKb9FP7Ag=:jlGQtNhVji5W71GscMmPXR tuf4mA//DTvfP3p2NjiHpVVvxrCE43li+qSBjKknSL06/G4ocjZE62mANptUCT/+CjP6ut8qZ lY59K8HuRhWsQAkqlLHPC5FdpABgBZKLrOWOcWPG+NLeWrhxldZcBsZECpNavRZmjHMLY6IfH 67E6f597G988MU9VtO4ixky/jn/W1ty6xApNpFVBvF7QsHCc3EN9fQ8XRXVdlwCYh3eKs5sh8 b2LsR+Ja4vHZoArcvWQ0S44Y3tRMyXfs01slU1tncNrjkbCxu5mBgFxdRJY2t9+we50ZGgo71 py9ka778ry8OF1EsAM+b7Cu3/EKg+ZA9Pk4Chj9RO4M7vWFhVI0plzVrd4RtOgmyQXC9/cG5R BsI3nWY0BmtBTltL6dTrxJWj8E/PkORh8t6YEpWNhJB4AbrbfWUS5OzuhZKE2Gio93X0Fwhk4 YHZy0QHTkf8uS8hJWlO51Ykg3QPAcDfXmohlPUtnzMMhlNMkccie8korS0q2qeHlL9VnMeTF6 VowTtsmbW+2wjQEZegYRtgOItZlwI2JqBa0mtJEMhGilHeKMsDdoee8xaW2GamKoabh5rzb3V rkFfg3GgOOmxE3Tur9jkqaSuRkYqo7Ou8yTBVHybhSNQbOwGvf9VAV3yyxNuDxrzXa3Dw4cSA xWhM4DWZupT3PiVVp4tjgV4ER23WtTgsSUGaIo7tofDdeVErCeZzQJFftBaFjpIikxX7u10mG VqfYIeF6jZgR0EO0itBKLSK7IWaxe30qqnBYeA== Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andrey Konovalov When cleaning up the configurations, make sure we only free the number of configurations and interfaces that we could have allocated. Reported-by: Andrey Konovalov Cc: stable Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 32fd87b3bbf5f7a045546401dfe2894dbbf4d8c3) Signed-off-by: Arnd Bergmann --- drivers/usb/core/config.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 2.20.0 diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 6a287c81a7be..b8eb289e0b17 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -734,18 +734,21 @@ void usb_destroy_configuration(struct usb_device *dev) return; if (dev->rawdescriptors) { - for (i = 0; i < dev->descriptor.bNumConfigurations; i++) + for (i = 0; i < dev->descriptor.bNumConfigurations && + i < USB_MAXCONFIG; i++) kfree(dev->rawdescriptors[i]); kfree(dev->rawdescriptors); dev->rawdescriptors = NULL; } - for (c = 0; c < dev->descriptor.bNumConfigurations; c++) { + for (c = 0; c < dev->descriptor.bNumConfigurations && + c < USB_MAXCONFIG; c++) { struct usb_host_config *cf = &dev->config[c]; kfree(cf->string); - for (i = 0; i < cf->desc.bNumInterfaces; i++) { + for (i = 0; i < cf->desc.bNumInterfaces && + i < USB_MAXINTERFACES; i++) { if (cf->intf_cache[i]) kref_put(&cf->intf_cache[i]->ref, usb_release_interface_cache);