Commit 49cd2f4d authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: misc: cypress_cy7c63: check for short transfer 



As we process the second byte of a control transfer, transfers
of less than 2 bytes must be discarded.

This bug is as old as the driver.

SIgned-off-by: default avatarOliver Neukum <oneukum@suse.com>
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240912125449.1030536-1-oneukum@suse.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8265d06b

drivers/usb/misc/cypress_cy7c63.c

+4 −0
Original line number Diff line number Diff line
@@ -88,6 +88,9 @@ static int vendor_command(struct cypress *dev, unsigned char request, 
				 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,

				 address, data, iobuf, CYPRESS_MAX_REQSIZE,

				 USB_CTRL_GET_TIMEOUT);

	/* we must not process garbage */

	if (retval < 2)

		goto err_buf;



	/* store returned data (more READs to be added) */

	switch (request) {
@@ -107,6 +110,7 @@ static int vendor_command(struct cypress *dev, unsigned char request, 
			break;

	}



err_buf:

	kfree(iobuf);

error:

	return retval;