Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77b52e37 authored by Vijayavardhan Vennapusa's avatar Vijayavardhan Vennapusa Committed by Mayank Rana
Browse files

USB: f_accessory: Check for length before updating accessory string 



It is possible that host sends SEND_STRING control request with zero
length and in that case, driver ends up setting string as NULL. This
results in CTS failure for accessory test. Hence add check for length
and update string only if length is nonzero.

Change-Id: I4594a46f830f45fc49f80a74ec6042383edf007d
Signed-off-by: default avatarVijayavardhan Vennapusa <vvreddy@codeaurora.org>
parent 4bb2701f

drivers/usb/gadget/function/f_accessory.c

+18 −13
Original line number Diff line number Diff line
@@ -346,6 +346,7 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req) 
	struct acc_dev	*dev = ep->driver_data;

	char *string_dest = NULL;

	int length = req->actual;

	unsigned long flags;



	if (req->status != 0) {

		pr_err("acc_complete_set_string, err %d\n", req->status);
@@ -371,9 +372,17 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req) 
	case ACCESSORY_STRING_SERIAL:

		string_dest = dev->serial;

		break;

	default:

		pr_err("unknown accessory string index %d\n",

					dev->string_index);

		return;

	}



	if (!length) {

		pr_debug("zero length for accessory string index %d\n",

						dev->string_index);

		return;

	}

	if (string_dest) {

		unsigned long flags;



	if (length >= ACC_STRING_SIZE)

		length = ACC_STRING_SIZE - 1;
@@ -383,10 +392,6 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req) 
	/* ensure zero termination */

	string_dest[length] = 0;

	spin_unlock_irqrestore(&dev->lock, flags);

	} else {

		pr_err("unknown accessory string index %d\n",

			dev->string_index);

	}

}



static void acc_complete_set_hid_report_desc(struct usb_ep *ep,