Hi,

On Tue, 9 Jan 2018 16:06:41 +0100 Greg KH gregkh@linuxfoundation.org wrote:

On Wed, Dec 20, 2017 at 03:14:09AM +0900, Masakazu Mokuno wrote:

...

As USB_DT_USB_SSP_CAP_SIZE() takes SSAC value as an argument, the low bound of the size for struct usb_ssp_cap_descriptor should be described by USB_DT_USB_SSP_CAP_SIZE(0), not by USB_DT_USB_SSP_CAP_SIZE(1)

The type-specific length check patch was added to stable and needs to be fixed as well.

Fixes: 81cf4a45360f ("USB: core: Add type-specific length check of BOS descriptors") Cc: linux-stable stable@vger.kernel.org Cc: Mathias Nyman mathias.nyman@linux.intel.com Signed-off-by: Masakazu Mokuno masakazu.mokuno@gmail.com

--

drivers/usb/core/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 78e92d2..33a3ab7 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -911,7 +911,7 @@ void usb_release_bos_descriptor(struct usb_device *dev) [USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE, [USB_CAP_TYPE_EXT] = USB_DT_USB_EXT_CAP_SIZE, [USB_SS_CAP_TYPE] = USB_DT_USB_SS_CAP_SIZE,

•   [USB_SSP_CAP_TYPE]          = USB_DT_USB_SSP_CAP_SIZE(1),
  

•   [USB_SSP_CAP_TYPE]          = USB_DT_USB_SSP_CAP_SIZE(0),
    [CONTAINER_ID_TYPE]         = USB_DT_USB_SS_CONTN_ID_SIZE,
    [USB_PTM_CAP_TYPE]          = USB_DT_USB_PTM_ID_SIZE,
  

};

-- Masakazu Mokuno

Patch is corrupted and can not be applied :(

I'm sorry. Tabs were expaned to white spaces. I'll resend fixed patch.