Messages in this thread |  | | | Date | Tue, 15 Jun 2010 14:10:36 +0400 | | From | Sergei Shtylyov <> | | Subject | Re: [PATCH] USB: gadget: g_fs: possible invalid pointer reference bug fixed |
| |
Hello.
Michal Nazarewicz wrote:
> During __gfs_do_config() some invalid pointers may be left > in usb_configuration::interfaces array from previous calls > to the __gfs_do_config() for the same configuration. This > will always happen if an user space function which has > a fewer then the last user space function registers itself. > Composite's set_config() function that a pointer after the > last interface in usb_configuration::interface is NULL > unless the array is full.
> This patch makes the __gfs_do_config() make sure that if the > usb_configuration::interface is not full then a pointer > after the last interface is NULL.
> Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com> > Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> > --- > drivers/usb/gadget/g_ffs.c | 11 +++++++++++ > 1 files changed, 11 insertions(+), 0 deletions(-)
> diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c > index 2f26470..da3a9e4 100644 > --- a/drivers/usb/gadget/g_ffs.c > +++ b/drivers/usb/gadget/g_ffs.c > @@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c, > if (unlikely(ret < 0)) > return ret; > > + /* After previous do_configs there may be some invalid > + * pointers in c->interface array. This happens every time > + * a user space function with fewer interfaces than a user > + * space function that was run before the new one is run. The > + * compasit's set_config() assumes that if there is no more > + * then MAX_CONFIG_INTERFACES interfaces in a configuration > + * then there is a NULL pointer after the last interface in > + * c->interface array. We need to make sure this is true. */
According to CodingStyle, the preferred style of the multi-line comments is this:
/* * bla * bla */ > + if (c->next_interface_id < ARRAY_SIZE(c->interface)) > + c->interface[c->next_interface_id] = NULL; > + > return 0; > }
WBR, Sergei
|  |