diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 6a287c81a7be7050248317974b7fe5f4295ce070..aef2085855440e6d0b7d894359684da4935c132a 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -902,8 +902,8 @@ int usb_get_bos_descriptor(struct usb_device *dev) /* Get BOS descriptor */ ret = usb_get_descriptor(dev, USB_DT_BOS, 0, bos, USB_DT_BOS_SIZE); - if (ret < USB_DT_BOS_SIZE) { - dev_err(ddev, "unable to get BOS descriptor\n"); + if (ret < USB_DT_BOS_SIZE || bos->bLength < USB_DT_BOS_SIZE) { + dev_err(ddev, "unable to get BOS descriptor or descriptor too short\n"); if (ret >= 0) ret = -ENOMSG; kfree(bos);