Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9720ff2 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "usb: gadget: Avoid NULL pointer dereference during OS descriptors handling"

parents f40f8c28 bb93c439

drivers/usb/gadget/composite.c

+8 −0
Original line number Diff line number Diff line
@@ -1588,6 +1588,9 @@ static int count_ext_prop(struct usb_configuration *c, int interface) 
	struct usb_function *f;

	int j;



	if (interface >= c->next_interface_id)

		return -EINVAL;



	f = c->interface[interface];

	for (j = 0; j < f->os_desc_n; ++j) {

		struct usb_os_desc *d;
@@ -1607,6 +1610,9 @@ static int len_ext_prop(struct usb_configuration *c, int interface) 
	struct usb_os_desc *d;

	int j, res;



	if (interface >= c->next_interface_id)

		return -EINVAL;



	res = 10; /* header length */

	f = c->interface[interface];

	for (j = 0; j < f->os_desc_n; ++j) {
@@ -1996,6 +2002,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 
				buf[6] = w_index;

				count = count_ext_prop(os_desc_cfg,

					interface);

				if (count < 0)

					return count;

				put_unaligned_le16(count, buf + 8);

				count = len_ext_prop(os_desc_cfg,

					interface);