Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 675272d0 authored by Jack Pham's avatar Jack Pham Committed by Felipe Balbi
Browse files

usb: gadget: f_fs: Use config_ep_by_speed() 



In commit 2bfa0719 ("usb: gadget: function: f_fs: pass
companion descriptor along") there is a pointer arithmetic
bug where the comp_desc is obtained as follows:

 comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
	       USB_DT_ENDPOINT_SIZE);

Since ds is a pointer to usb_endpoint_descriptor, adding
7 to it ends up going out of bounds (7 * sizeof(struct
usb_endpoint_descriptor), which is actually 7*9 bytes) past
the SS descriptor. As a result the maxburst value will be
read incorrectly, and the UDC driver will also get a garbage
comp_desc (assuming it uses it).

Since Felipe wrote, "Eventually, f_fs.c should be converted
to use config_ep_by_speed() like all other functions, though",
let's finally do it. This allows the other usb_ep fields to
be properly populated, such as maxpacket and mult. It also
eliminates the awkward speed-based descriptor lookup since
config_ep_by_speed() does that already using the ones found
in struct usb_function.

Fixes: 2bfa0719 ("usb: gadget: function: f_fs: pass companion descriptor along")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent 6cf439e0

drivers/usb/gadget/function/f_fs.c

+7 −31
Original line number Diff line number Diff line
@@ -1855,44 +1855,20 @@ static int ffs_func_eps_enable(struct ffs_function *func) 


	spin_lock_irqsave(&func->ffs->eps_lock, flags);

	while(count--) {

		struct usb_endpoint_descriptor *ds;

		struct usb_ss_ep_comp_descriptor *comp_desc = NULL;

		int needs_comp_desc = false;

		int desc_idx;



		if (ffs->gadget->speed == USB_SPEED_SUPER) {

			desc_idx = 2;

			needs_comp_desc = true;

		} else if (ffs->gadget->speed == USB_SPEED_HIGH)

			desc_idx = 1;

		else

			desc_idx = 0;



		/* fall-back to lower speed if desc missing for current speed */

		do {

			ds = ep->descs[desc_idx];

		} while (!ds && --desc_idx >= 0);



		if (!ds) {

			ret = -EINVAL;

			break;

		}



		ep->ep->driver_data = ep;

		ep->ep->desc = ds;



		if (needs_comp_desc) {

			comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +

					USB_DT_ENDPOINT_SIZE);

			ep->ep->maxburst = comp_desc->bMaxBurst + 1;

			ep->ep->comp_desc = comp_desc;

		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);

		if (ret) {

			pr_err("%s: config_ep_by_speed(%s) returned %d\n",

					__func__, ep->ep->name, ret);

			break;

		}



		ret = usb_ep_enable(ep->ep);

		if (likely(!ret)) {

			epfile->ep = ep;

			epfile->in = usb_endpoint_dir_in(ds);

			epfile->isoc = usb_endpoint_xfer_isoc(ds);

			epfile->in = usb_endpoint_dir_in(ep->ep->desc);

			epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc);

		} else {

			break;

		}