Commit 4f12e513 authored May 04, 2016 by Hemant Kumar Committed by Gerrit - the friendly Code Review server Oct 23, 2017

usb: gadget: composite: Handle OS descriptor request properly



In case w_index or w_value of an OS descriptor does not match
for a device or an interface, value remains set to -EOPNOTSUPP.
This is assigned to an unsigned request length and becomes a
large integer value. When driver tries to allocate a buffer
of this large integer value DMA allocator complaints for out of
SW-IOMMU space. Hence check this variable for negative value and
return without queuing ep0 request.

CRs-Fixed: 1013316
Change-Id: I705d0d54fb17ca3042533f0106f91912215bd52a
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>

parent 8c88a114

drivers/usb/gadget/composite.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -1921,6 +1921,16 @@ unknown:
		}
		break;
		}

		if (value < 0) {
		DBG(cdev, "%s: unhandled os desc request\n",
		__func__);
		DBG(cdev, "req%02x.%02x v%04x i%04x l%d\n",
		ctrl->bRequestType, ctrl->bRequest,
		w_value, w_index, w_length);
		return value;
		}

		req->length = value;
		req->zero = value < w_length;
		value = usb_ep_queue(gadget->ep0, req, GFP_ATOMIC);