Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d45a18a authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Bharath
Browse files

UPSTREAM: USB: gadget: zero allocate endpoint 0 buffers 



Under some conditions, USB gadget devices can show allocated buffer
contents to a host.  Fix this up by zero-allocating them so that any
extra data will all just be zeros.

Reported-by: default avatarSzymon Heidrich <szymon.heidrich@gmail.com>
Tested-by: default avatarSzymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 86ebbc11bb3f60908a51f3e41a17e3f477c2eaa3)
Bug: 210292367
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I72b4376cd4296a8b8af0ade2d702cd420146f3aa
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Issue: FP3SEC-288
(cherry picked from commit 0a638b26)
(cherry picked from commit 5f6ada8bd0b2620b6166176dc6e7769cc368bd21)
parent 57049607

drivers/usb/gadget/composite.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -2334,7 +2334,7 @@ int composite_dev_prepare(struct usb_composite_driver *composite, 
	if (!cdev->req)

	if (!cdev->req)

		return -ENOMEM;

		return -ENOMEM;





	cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ +

	cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ +

				(gadget->extra_buf_alloc), GFP_KERNEL);

				(gadget->extra_buf_alloc), GFP_KERNEL);

	if (!cdev->req->buf)

	if (!cdev->req->buf)

		goto fail;

		goto fail;

drivers/usb/gadget/legacy/dbgp.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -136,7 +136,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep) 
		goto fail_1;

		goto fail_1;

	}

	}





	req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL);

	req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL);

	if (!req->buf) {

	if (!req->buf) {

		err = -ENOMEM;

		err = -ENOMEM;

		stp = 2;

		stp = 2;