Re: [PATCH 1/3] usb: core: Add size check to find_next_descriptor()

[Alan Stern]

On Mon, Jul 13, 2026 at 05:43:51PM +0200, Griffin Kroah-Hartman wrote:
> Add a size check for the descriptor header in find_next_descriptor().
> This prevents a scenario where h->blength = 0, causing the while loop to
> spin forever.

Just as before, this check has already been performed by 
usb_parse_configuration().  It doesn't need to be performed again.

Alan Stern

> Assisted-by: gkh_clanker_t1000
> Signed-off-by: Griffin Kroah-Hartman <griffin@xxxxxxxxx>
> ---
>  drivers/usb/core/config.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
> index 45e20c6d76c0..17c93e95945f 100644
> --- a/drivers/usb/core/config.c
> +++ b/drivers/usb/core/config.c
> @@ -29,6 +29,8 @@ static int find_next_descriptor(unsigned char *buffer, int size,
>  	/* Find the next descriptor of type dt1 or dt2 */
>  	while (size > 0) {
>  		h = (struct usb_descriptor_header *) buffer;
> +		if (h->bLength < sizeof(struct usb_descriptor_header))
> +			break;
>  		if (h->bDescriptorType == dt1 || h->bDescriptorType == dt2)
>  			break;
>  		buffer += h->bLength;
> 
> -- 
> 2.55.0
> 
>