Merge "USB: f_accessory: Check for length before updating accessory string" (6ac9ecb4) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/usb/gadget/function/f_accessory.c

+18 −13

Original line number	Diff line number	Diff line
		@@ -346,6 +346,7 @@ static void acc_complete_set_string(struct usb_ep ep, struct usb_request req)
		struct acc_dev *dev = ep->driver_data;
		char *string_dest = NULL;
		int length = req->actual;
		unsigned long flags;

		if (req->status != 0) {
		pr_err("acc_complete_set_string, err %d\n", req->status);
		@@ -371,9 +372,17 @@ static void acc_complete_set_string(struct usb_ep ep, struct usb_request req)
		case ACCESSORY_STRING_SERIAL:
		string_dest = dev->serial;
		break;
		default:
		pr_err("unknown accessory string index %d\n",
		dev->string_index);
		return;
		}

		if (!length) {
		pr_debug("zero length for accessory string index %d\n",
		dev->string_index);
		return;
		}
		if (string_dest) {
		unsigned long flags;

		if (length >= ACC_STRING_SIZE)
		length = ACC_STRING_SIZE - 1;
		@@ -383,10 +392,6 @@ static void acc_complete_set_string(struct usb_ep ep, struct usb_request req)
		/* ensure zero termination */
		string_dest[length] = 0;
		spin_unlock_irqrestore(&dev->lock, flags);
		} else {
		pr_err("unknown accessory string index %d\n",
		dev->string_index);
		}
		}

		static void acc_complete_set_hid_report_desc(struct usb_ep *ep,