Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfc0e256 authored by Sriharsha Allenki's avatar Sriharsha Allenki
Browse files

usb: gadget: Remove assigning the function descriptors 



The usb_assign_descriptors copies the descriptors depending
on the maximum speed supported by the gadget.
If the function drivers unconditionally assign the
descriptors and the speed is limited to full, the switching
to the same function would lead to a use after free.
Fix this by removing unconditional assigning of descriptors
in the function drivers.

Change-Id: Id283c87d6f3ccf708507afb66a3b93121022e990
Signed-off-by: default avatarSriharsha Allenki <sallenki@codeaurora.org>
parent f49a073b

drivers/usb/gadget/function/f_ccid.c

+1 −4
Original line number Diff line number Diff line 
/*

 * f_ccid.c -- CCID function Driver

 *

 * Copyright (c) 2011, 2013, 2017 The Linux Foundation. All rights reserved.

 * Copyright (c) 2011, 2013, 2017, 2020, The Linux Foundation. All rights reserved.



 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1042,9 +1042,6 @@ static int ccid_bind_config(struct f_ccid *ccid_dev) 
	pr_debug("%s\n", __func__);



	ccid_dev->function.name = FUNCTION_NAME;

	ccid_dev->function.fs_descriptors = ccid_fs_descs;

	ccid_dev->function.hs_descriptors = ccid_hs_descs;

	ccid_dev->function.ss_descriptors = ccid_ss_descs;

	ccid_dev->function.bind = ccid_function_bind;

	ccid_dev->function.unbind = ccid_function_unbind;

	ccid_dev->function.set_alt = ccid_function_set_alt;

drivers/usb/gadget/function/f_diag.c

+0 −2
Original line number Diff line number Diff line
@@ -854,8 +854,6 @@ static struct diag_context *diag_context_init(const char *name) 
	dev->ch = _ch;



	dev->function.name = _ch->name;

	dev->function.fs_descriptors = fs_diag_desc;

	dev->function.hs_descriptors = hs_diag_desc;

	dev->function.bind = diag_function_bind;

	dev->function.unbind = diag_function_unbind;

	dev->function.set_alt = diag_function_set_alt;

drivers/usb/gadget/function/f_qdss.c

+0 −2
Original line number Diff line number Diff line
@@ -1205,8 +1205,6 @@ static struct usb_function *qdss_alloc(struct usb_function_instance *fi) 
	struct f_qdss *usb_qdss = opts->usb_qdss;



	usb_qdss->port.function.name = "usb_qdss";

	usb_qdss->port.function.fs_descriptors = qdss_fs_desc;

	usb_qdss->port.function.hs_descriptors = qdss_hs_desc;

	usb_qdss->port.function.strings = qdss_strings;

	usb_qdss->port.function.bind = qdss_bind;

	usb_qdss->port.function.unbind = qdss_unbind;