leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

usb: gadget: storage: check for valid USB_BULK_GET_MAX_LUN_REQUEST

Browse Source 
The latest USB-IF CV tester checks for a valid length for this
request.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Paul Zimmerman 2011-10-13 17:46:36 -07:00 committed by Greg Kroah-Hartman
parent b7a8d17db9
commit db332bc9b2
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/usb/gadget/f_mass_storage.c
View File

@ -639,7 +639,8 @@ static int fsg_setup(struct usb_function *f,
if (ctrl->bRequestType !=
(USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
break;
if (w_index != fsg->interface_number || w_value != 0)
if (w_index != fsg->interface_number || w_value != 0 ||
w_length != 1)
return -EDOM;
VDBG(fsg, "get max LUN\n");
*(u8 *)req->buf = fsg->common->nluns - 1;

2
drivers/usb/gadget/file_storage.c
View File

@ -875,7 +875,7 @@ static int class_setup_req(struct fsg_dev *fsg,
if (ctrl->bRequestType != (USB_DIR_IN |
USB_TYPE_CLASS | USB_RECIP_INTERFACE))
break;
if (w_index != 0 || w_value != 0) {
if (w_index != 0 || w_value != 0 || w_length != 1) {
value = -EDOM;
break;
}