tree 0ac8f95b7677441adafef1e513c2d56955e08586
parent 2c25a2c818023df64463aac3288a9f969491e507
author Johan Hovold <johan@kernel.org> 1494433108 +0200
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1495014782 +0200

USB: hub: fix non-SS hub-descriptor handling

Add missing sanity check on the non-SuperSpeed hub-descriptor length in
order to avoid parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes (or a compound-device debug
statement).

Note that we only make sure that the DeviceRemovable field is always
present (and specifically ignore the unused PortPwrCtrlMask field) in
order to continue support any hubs with non-compliant descriptors. As a
further safeguard, the descriptor buffer is also cleared.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>     # 2.6.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>