Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db332bc9 authored by Paul Zimmerman's avatar Paul Zimmerman Committed by Greg Kroah-Hartman
Browse files

usb: gadget: storage: check for valid USB_BULK_GET_MAX_LUN_REQUEST 



The latest USB-IF CV tester checks for a valid length for this
request.

Signed-off-by: default avatarPaul Zimmerman <paulz@synopsys.com>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent b7a8d17d

drivers/usb/gadget/f_mass_storage.c

+2 −1
Original line number Diff line number Diff line
@@ -639,7 +639,8 @@ static int fsg_setup(struct usb_function *f, 
		if (ctrl->bRequestType !=

		    (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))

			break;

		if (w_index != fsg->interface_number || w_value != 0)

		if (w_index != fsg->interface_number || w_value != 0 ||

				w_length != 1)

			return -EDOM;

		VDBG(fsg, "get max LUN\n");

		*(u8 *)req->buf = fsg->common->nluns - 1;

drivers/usb/gadget/file_storage.c

+1 −1
Original line number Diff line number Diff line
@@ -875,7 +875,7 @@ static int class_setup_req(struct fsg_dev *fsg, 
			if (ctrl->bRequestType != (USB_DIR_IN |

					USB_TYPE_CLASS | USB_RECIP_INTERFACE))

				break;

			if (w_index != 0 || w_value != 0) {

			if (w_index != 0 || w_value != 0 || w_length != 1) {

				value = -EDOM;

				break;

			}