--- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -820,9 +820,13 @@ int usb_string(struct usb_device *dev, i if (dev->state == USB_STATE_SUSPENDED) return -EHOSTUNREACH; - if (size <= 0 || !buf || !index) + if (size <= 0 || !buf) return -EINVAL; buf[0] = 0; + if (index <= 0 || index >= 256) { + pr_info("Invalid index %d\n", index); + return -EINVAL; + } tbuf = kmalloc(256, GFP_NOIO); if (!tbuf) return -ENOMEM;