From: Vincent Pelletier Date: Tue, 17 Jan 2017 13:20:11 +0000 (+0000) Subject: usb: gadger: f_fs: Do not copy past descriptor end. X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=f199a80cfece94b67f9e3d2955666e47c6051517;p=linux.git usb: gadger: f_fs: Do not copy past descriptor end. Endpoint descriptors come in 2 sizes, struct usb_endpoint_descriptor being the largest. Use bLength to stop on endpoint descriptor boundary, and not 2 bytes too far. Signed-off-by: Vincent Pelletier Signed-off-by: Felipe Balbi --- diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 5e746adc8a2d5..e126897a7faed 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1230,7 +1230,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code, desc = epfile->ep->descs[desc_idx]; spin_unlock_irq(&epfile->ffs->eps_lock); - ret = copy_to_user((void *)value, desc, sizeof(*desc)); + ret = copy_to_user((void *)value, desc, desc->bLength); if (ret) ret = -EFAULT; return ret;