Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Verified Commit 8f38abe8 authored by android-t1's avatar android-t1 Committed by Ahmed Harhash
Browse files

Integrate security patch 2023-04-05-CVE-2023-20941 

Change-Id: I4720a2c98326a10ead30d8ccca130b474da69653
parent e9347fb1

drivers/usb/gadget/configfs.c

+2 −2
Original line number Diff line number Diff line
@@ -20,7 +20,7 @@ 
#endif



#ifdef CONFIG_USB_CONFIGFS_F_ACC

extern int acc_ctrlrequest(struct usb_composite_dev *cdev,

extern int acc_ctrlrequest_composite(struct usb_composite_dev *cdev,

				const struct usb_ctrlrequest *ctrl);

void acc_disconnect(void);

#endif
@@ -1640,7 +1640,7 @@ static int android_setup(struct usb_gadget *gadget, 


#ifdef CONFIG_USB_CONFIGFS_F_ACC

	if (value < 0)

		value = acc_ctrlrequest(cdev, c);

		value = acc_ctrlrequest_composite(cdev, c);

#endif



	if (value < 0)

drivers/usb/gadget/function/f_accessory.c

+20 −0
Original line number Diff line number Diff line
@@ -938,6 +938,26 @@ int acc_ctrlrequest(struct usb_composite_dev *cdev, 
}

EXPORT_SYMBOL_GPL(acc_ctrlrequest);



int acc_ctrlrequest_composite(struct usb_composite_dev *cdev,

			      const struct usb_ctrlrequest *ctrl)

{

	u16 w_length = le16_to_cpu(ctrl->wLength);



	if (w_length > USB_COMP_EP0_BUFSIZ) {

		if (ctrl->bRequestType & USB_DIR_IN) {

			/* Cast away the const, we are going to overwrite on purpose. */

			__le16 *temp = (__le16 *)&ctrl->wLength;



			*temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);

			w_length = USB_COMP_EP0_BUFSIZ;

		} else {

			return -EINVAL;

		}

	}

	return acc_ctrlrequest(cdev, ctrl);

}

EXPORT_SYMBOL_GPL(acc_ctrlrequest_composite);



static int

__acc_function_bind(struct usb_configuration *c,

			struct usb_function *f, bool configfs)