duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "UPSTREAM: USB: gadget: validate interface OS descriptor requests"

Browse Source
This commit is contained in:
qctecmdr authored and Gerrit - the friendly Code Review server committed 2022-06-23 10:54:18 -07:00
2 parents a4bb12ce13 14d6044701
commit b50c828436
2 files changed
+9 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

drivers/usb/gadget/composite.c
+3
View File
@@ -2062,6 +2062,9 @@ unknown:
if (w_index != 0x5 || (w_value >> 8))
break;
interface = w_value & 0xFF;
if (interface >= MAX_CONFIG_INTERFACES ||
!os_desc_cfg->interface[interface])
break;
buf[6] = w_index;
count = count_ext_prop(os_desc_cfg,
interface);
drivers/usb/gadget/function/rndis.c
+6 -3
View File
@@ -633,14 +633,17 @@ static int rndis_set_response(struct rndis_params *params,
rndis_set_cmplt_type *resp;
rndis_resp_t *r;
BufLength = le32_to_cpu(buf->InformationBufferLength);
BufOffset = le32_to_cpu(buf->InformationBufferOffset);
if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
(BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
return -EINVAL;
r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_set_cmplt_type *)r->buf;
BufLength = le32_to_cpu(buf->InformationBufferLength);
BufOffset = le32_to_cpu(buf->InformationBufferOffset);
#ifdef VERBOSE_DEBUG
pr_debug("%s: Length: %d\n", __func__, BufLength);
pr_debug("%s: Offset: %d\n", __func__, BufOffset);