USB: Fix SS endpoint companion descriptor parsing.

commit 6682bb39e111b34290e25c4d275c5bcf8bbccbe1 upstream.

When there's a descriptor after the SuperSpeed endpoint companion
descriptor, the previous code would have skipped over twice the length it
was supposed to.  This code fixes crashes seen with UASP devices (which
have a UASP descriptor after the SS endpoint companion descriptor).

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index a16c538d0132958ab330b6993267663d45d4c4ef..0d3af6a6ee4992d258e44bc9228d7e91c81a4f2a 100644 (file)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -105,7 +105,7 @@ static int usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
        ep->ss_ep_comp->extralen = i;
        buffer += i;
        size -= i;
-       retval = buffer - buffer_start + i;
+       retval = buffer - buffer_start;
        if (num_skipped > 0)
                dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
                                num_skipped, plural(num_skipped),