| From 5a36d135c00c66a39bb142dbcd888c4f4fd0d430 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 28 Sep 2025 14:56:11 -0400 |
| Subject: USB: Fix descriptor count when handling invalid MBIM extended |
| descriptor |
| |
| From: Seungjin Bae <eeodqql09@gmail.com> |
| |
| [ Upstream commit 5570ad1423ee60f6e972dadb63fb2e5f90a54cbe ] |
| |
| In cdc_parse_cdc_header(), the check for the USB_CDC_MBIM_EXTENDED_TYPE |
| descriptor was using 'break' upon detecting an invalid length. |
| |
| This was incorrect because 'break' only exits the switch statement, |
| causing the code to fall through to cnt++, thus incorrectly |
| incrementing the count of parsed descriptors for a descriptor that was |
| actually invalid and being discarded. |
| |
| This patch changes 'break' to 'goto next_desc;' to ensure that the |
| logic skips the counter increment and correctly proceeds to the next |
| descriptor in the buffer. This maintains an accurate count of only |
| the successfully parsed descriptors. |
| |
| Fixes: e4c6fb7794982 ("usbnet: move the CDC parser into USB core") |
| Signed-off-by: Seungjin Bae <eeodqql09@gmail.com> |
| Link: https://lore.kernel.org/r/20250928185611.764589-1-eeodqql09@gmail.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/usb/core/message.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c |
| index 077dfe48d01c1..5a5dfbf995e3a 100644 |
| --- a/drivers/usb/core/message.c |
| +++ b/drivers/usb/core/message.c |
| @@ -2428,7 +2428,7 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, |
| break; |
| case USB_CDC_MBIM_EXTENDED_TYPE: |
| if (elength < sizeof(struct usb_cdc_mbim_extended_desc)) |
| - break; |
| + goto next_desc; |
| hdr->usb_cdc_mbim_extended_desc = |
| (struct usb_cdc_mbim_extended_desc *)buffer; |
| break; |
| -- |
| 2.51.0 |
| |
