[PATCH] usb: appledisplay: validate interrupt report length

[Pengpeng Hou]

A successful interrupt URB completion can still carry fewer bytes than the
two-byte report consumed by appledisplay_complete(). The callback
unconditionally reads urbdata[1].

Resubmit short successful reports without parsing them.

Fixes: 069e8a65cd79 ("[PATCH] Driver for Apple Cinema Display")
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/usb/misc/appledisplay.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index 16883592f7fc6..4543545793e27 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -82,6 +82,8 @@ static void appledisplay_complete(struct urb *urb)
 	switch (status) {
 	case 0:
 		/* success */
+		if (urb->actual_length < ACD_URB_BUFFER_LEN)
+			goto exit;
 		break;
 	case -EOVERFLOW:
 		dev_err(dev,

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1