lkml.org 
[lkml]   [2010]   [Jun]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] USB: gadget: g_fs: possible invalid pointer reference bug fixed
    Hello.

    Michal Nazarewicz wrote:

    > During __gfs_do_config() some invalid pointers may be left
    > in usb_configuration::interfaces array from previous calls
    > to the __gfs_do_config() for the same configuration. This
    > will always happen if an user space function which has
    > a fewer then the last user space function registers itself.
    > Composite's set_config() function that a pointer after the
    > last interface in usb_configuration::interface is NULL
    > unless the array is full.

    > This patch makes the __gfs_do_config() make sure that if the
    > usb_configuration::interface is not full then a pointer
    > after the last interface is NULL.

    > Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
    > Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
    > ---
    > drivers/usb/gadget/g_ffs.c | 11 +++++++++++
    > 1 files changed, 11 insertions(+), 0 deletions(-)

    > diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
    > index 2f26470..da3a9e4 100644
    > --- a/drivers/usb/gadget/g_ffs.c
    > +++ b/drivers/usb/gadget/g_ffs.c
    > @@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c,
    > if (unlikely(ret < 0))
    > return ret;
    >
    > + /* After previous do_configs there may be some invalid
    > + * pointers in c->interface array. This happens every time
    > + * a user space function with fewer interfaces than a user
    > + * space function that was run before the new one is run. The
    > + * compasit's set_config() assumes that if there is no more
    > + * then MAX_CONFIG_INTERFACES interfaces in a configuration
    > + * then there is a NULL pointer after the last interface in
    > + * c->interface array. We need to make sure this is true. */

    According to CodingStyle, the preferred style of the multi-line comments
    is this:

    /*
    * bla
    * bla
    */

    > + if (c->next_interface_id < ARRAY_SIZE(c->interface))
    > + c->interface[c->next_interface_id] = NULL;
    > +
    > return 0;
    > }

    WBR, Sergei



    \
     
     \ /
      Last update: 2010-06-15 12:19    [W:0.022 / U:90.192 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site