lkml.org 
[lkml]   [2011]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[34/91] usb: gadget: rndis: dont test against req->length
    2.6.32-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Felipe Balbi <balbi@ti.com>

    commit 472b91274a6c6857877b5caddb875dcb5ecdfcb8 upstream.

    composite.c always sets req->length to zero
    and expects function driver's setup handlers
    to return the amount of bytes to be used
    on req->length. If we test against req->length
    w_length will always be greater than req->length
    thus making us always stall that particular
    SEND_ENCAPSULATED_COMMAND request.

    Tested against a Windows XP SP3.

    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/gadget/f_rndis.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/usb/gadget/f_rndis.c
    +++ b/drivers/usb/gadget/f_rndis.c
    @@ -400,8 +400,7 @@ rndis_setup(struct usb_function *f, cons
    */
    case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
    | USB_CDC_SEND_ENCAPSULATED_COMMAND:
    - if (w_length > req->length || w_value
    - || w_index != rndis->ctrl_id)
    + if (w_value || w_index != rndis->ctrl_id)
    goto invalid;
    /* read the request; process it later */
    value = w_length;



    \
     
     \ /
      Last update: 2011-06-16 09:11    [W:3.377 / U:0.468 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site