Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6010c8b authored by Jim Lin's avatar Jim Lin Committed by Felipe Balbi
Browse files

usb: gadget: f_fs: Fix kernel panic if use_os_string not set 



If c->cdev->use_os_string flag is not set,
don't need to invoke ffs_do_os_descs() in _ffs_func_bind.
So uninitialized ext_compat_id pointer won't be accessed by
__ffs_func_bind_do_os_desc to cause kernel panic.

Signed-off-by: default avatarJim Lin <jilin@nvidia.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent e877b729

drivers/usb/gadget/function/f_fs.c

+10 −8
Original line number Original line Diff line number Diff line
@@ -2849,7 +2849,7 @@ static int _ffs_func_bind(struct usb_configuration *c, 
		goto error;

		goto error;





	func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);

	func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);

	if (c->cdev->use_os_string)

	if (c->cdev->use_os_string) {

		for (i = 0; i < ffs->interfaces_count; ++i) {

		for (i = 0; i < ffs->interfaces_count; ++i) {

			struct usb_os_desc *desc;

			struct usb_os_desc *desc;
@@ -2863,10 +2863,12 @@ static int _ffs_func_bind(struct usb_configuration *c, 
		ret = ffs_do_os_descs(ffs->ms_os_descs_count,

		ret = ffs_do_os_descs(ffs->ms_os_descs_count,

				      vla_ptr(vlabuf, d, raw_descs) +

				      vla_ptr(vlabuf, d, raw_descs) +

				      fs_len + hs_len + ss_len,

				      fs_len + hs_len + ss_len,

			      d_raw_descs__sz - fs_len - hs_len - ss_len,

				      d_raw_descs__sz - fs_len - hs_len -

				      ss_len,

				      __ffs_func_bind_do_os_desc, func);

				      __ffs_func_bind_do_os_desc, func);

		if (unlikely(ret < 0))

		if (unlikely(ret < 0))

			goto error;

			goto error;

	}

	func->function.os_desc_n =

	func->function.os_desc_n =

		c->cdev->use_os_string ? ffs->interfaces_count : 0;

		c->cdev->use_os_string ? ffs->interfaces_count : 0;