diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 5286640..f76b2e0a 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2251,7 +2251,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)/* descriptor may appear anywhere in config */err = __usb_get_extra_descriptor(udev->rawdescriptors[0],le16_to_cpu(udev->config[0].desc.wTotalLength),
-                USB_DT_OTG, (void **) &desc);
+                USB_DT_OTG, (void **) &desc, sizeof(*desc));if (err || !(desc->bmAttributes & USB_OTG_HNP))return 0;diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 79d8bd7..4ebfbd7 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);*/int __usb_get_extra_descriptor(char *buffer, unsigned size,
-                   unsigned char type, void **ptr)
+                   unsigned char type, void **ptr, size_t minsize){struct usb_descriptor_header *header;while (size >= sizeof(struct usb_descriptor_header)) {header = (struct usb_descriptor_header *)buffer;-        if (header->bLength < 2) {
+        if (header->bLength < 2 || header->bLength > size) {printk(KERN_ERR"%s: bogus descriptor, type %d length %d\n",usbcore_name,
@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,return -1;}-        if (header->bDescriptorType == type) {
+        if (header->bDescriptorType == type && header->bLength >= minsize) {*ptr = header;return 0;}
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index 684d6f0..09a8ebd 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -640,7 +640,7 @@ static int hwahc_security_create(struct hwahc *hwahc)top = itr + itr_size;result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
-            USB_DT_SECURITY, (void **) &secd);
+            USB_DT_SECURITY, (void **) &secd, sizeof(*secd));if (result == -1) {dev_warn(dev, "BUG? WUSB host has no security descriptors\n");return 0;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 4cdd515..5e49e82 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -407,11 +407,11 @@ struct usb_host_bos {};int __usb_get_extra_descriptor(char *buffer, unsigned size,
-    unsigned char type, void **ptr);
+    unsigned char type, void **ptr, size_t min);#define usb_get_extra_descriptor(ifpoint, type, ptr) \__usb_get_extra_descriptor((ifpoint)->extra, \(ifpoint)->extralen, \
-                type, (void **)ptr)
+                type, (void **)ptr, sizeof(**(ptr)))

struct usb_descriptor_header {__u8  bLength;__u8  bDescriptorType;
} __attribute__ ((packed));struct usb_device_descriptor {__u8  bLength;__u8  bDescriptorType;__le16 bcdUSB;__u8  bDeviceClass;__u8  bDeviceSubClass;__u8  bDeviceProtocol;__u8  bMaxPacketSize0;__le16 idVendor;__le16 idProduct;__le16 bcdDevice;__u8  iManufacturer;__u8  iProduct;__u8  iSerialNumber;__u8  bNumConfigurations;
} __attribute__ ((packed));struct usb_config_descriptor {__u8  bLength;__u8  bDescriptorType;__le16 wTotalLength;__u8  bNumInterfaces;__u8  bConfigurationValue;__u8  iConfiguration;__u8  bmAttributes;__u8  bMaxPower;
} __attribute__ ((packed));struct usb_string_descriptor {__u8  bLength;__u8  bDescriptorType;__le16 wData[1];        /* UTF-16LE encoded */
} __attribute__ ((packed));struct usb_interface_descriptor {__u8  bLength;__u8  bDescriptorType;__u8  bInterfaceNumber;__u8  bAlternateSetting;__u8  bNumEndpoints;__u8  bInterfaceClass;__u8  bInterfaceSubClass;__u8  bInterfaceProtocol;__u8  iInterface;
} __attribute__ ((packed));struct usb_endpoint_descriptor {__u8  bLength;__u8  bDescriptorType;__u8  bEndpointAddress;__u8  bmAttributes;__le16 wMaxPacketSize;__u8  bInterval;/* NOTE:  these two are _only_ in audio endpoints. *//* use USB_DT_ENDPOINT*_SIZE in bLength, not sizeof. */__u8  bRefresh;__u8  bSynchAddress;
} __attribute__ ((packed));

struct usb_host_endpoint {struct usb_endpoint_descriptor        desc;struct usb_ss_ep_comp_descriptor    ss_ep_comp;struct list_head        urb_list;void                *hcpriv;struct ep_device        *ep_dev;    /* For sysfs info */unsigned char *extra;   /* Extra descriptors */int extralen;int enabled;
};

int __usb_get_extra_descriptor(char *buffer, unsigned size,unsigned char type, void **ptr)
{struct usb_descriptor_header *header;while (size >= sizeof(struct usb_descriptor_header)) {header = (struct usb_descriptor_header *)buffer;if (header->bLength < 2) {printk(KERN_ERR"%s: bogus descriptor, type %d length %d\n",usbcore_name,header->bDescriptorType,header->bLength);return -1;}if (header->bDescriptorType == type) {*ptr = header;return 0;}buffer += header->bLength;size -= header->bLength;}return -1;
}
EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);

__usb_get_extra_descriptor (udev->rawdescriptors[0],le16_to_cpu(udev->config[0].desc.wTotalLength),USB_DT_OTG, (void **) &desc) == 0)

result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),USB_DT_SECURITY, (void **) &secd);