Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bcdf0c02 authored by android-t1's avatar android-t1
Browse files

Integrate security patch 2022-05-05-CVE-2022-20009 

Change-Id: Ic6c9ab45bd42d190ef38d791e5fca664ab02f49e
parent 7d88aea8

drivers/usb/gadget/composite.c

+3 −0
Original line number Diff line number Diff line
@@ -2062,6 +2062,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
				if (w_index != 0x5 || (w_value >> 8))

					break;

				interface = w_value & 0xFF;

				if (interface >= MAX_CONFIG_INTERFACES ||

				    !os_desc_cfg->interface[interface])

					break;

				buf[6] = w_index;

				count = count_ext_prop(os_desc_cfg,

					interface);

drivers/usb/gadget/function/rndis.c

+6 −3
Original line number Diff line number Diff line
@@ -633,14 +633,17 @@ static int rndis_set_response(struct rndis_params *params, 
	rndis_set_cmplt_type *resp;

	rndis_resp_t *r;



	BufLength = le32_to_cpu(buf->InformationBufferLength);

	BufOffset = le32_to_cpu(buf->InformationBufferOffset);

	if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||

	    (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))

		    return -EINVAL;



	r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));

	if (!r)

		return -ENOMEM;

	resp = (rndis_set_cmplt_type *)r->buf;



	BufLength = le32_to_cpu(buf->InformationBufferLength);

	BufOffset = le32_to_cpu(buf->InformationBufferOffset);



#ifdef	VERBOSE_DEBUG

	pr_debug("%s: Length: %d\n", __func__, BufLength);

	pr_debug("%s: Offset: %d\n", __func__, BufOffset);