Messages in this thread Patch in this message | | | From | Andi Kleen <> | Subject | [PATCH] [18/99] usb: gadget: rndis: don't test against req->length | Date | Wed, 27 Jul 2011 14:48:16 -0700 (PDT) |
| |
2.6.35-longterm review patch. If anyone has any objections, please let me know.
------------------ From: Felipe Balbi <balbi@ti.com>
commit 472b91274a6c6857877b5caddb875dcb5ecdfcb8 upstream.
composite.c always sets req->length to zero and expects function driver's setup handlers to return the amount of bytes to be used on req->length. If we test against req->length w_length will always be greater than req->length thus making us always stall that particular SEND_ENCAPSULATED_COMMAND request.
Tested against a Windows XP SP3.
Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Andi Kleen <ak@linux.intel.com>
--- drivers/usb/gadget/f_rndis.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
Index: linux-2.6.35.y/drivers/usb/gadget/f_rndis.c =================================================================== --- linux-2.6.35.y.orig/drivers/usb/gadget/f_rndis.c +++ linux-2.6.35.y/drivers/usb/gadget/f_rndis.c @@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, cons */ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8) | USB_CDC_SEND_ENCAPSULATED_COMMAND: - if (w_length > req->length || w_value - || w_index != rndis->ctrl_id) + if (w_value || w_index != rndis->ctrl_id) goto invalid; /* read the request; process it later */ value = w_length;
| |