diff options
| author | Paul Zimmerman <Paul.Zimmerman@synopsys.com> | 2011-10-13 17:46:36 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-14 11:51:24 -0800 |
| commit | db332bc9b26bbd79a37241721cccc9919489d5a9 (patch) | |
| tree | 37e48041f7e0eb2f53bedf186e6a633bd546b6d0 /drivers/usb | |
| parent | b7a8d17db9a86db1040862600cf3a02848f83844 (diff) | |
| download | talos-obmc-linux-db332bc9b26bbd79a37241721cccc9919489d5a9.tar.gz talos-obmc-linux-db332bc9b26bbd79a37241721cccc9919489d5a9.zip | |
usb: gadget: storage: check for valid USB_BULK_GET_MAX_LUN_REQUEST
The latest USB-IF CV tester checks for a valid length for this
request.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/f_mass_storage.c | 3 | ||||
| -rw-r--r-- | drivers/usb/gadget/file_storage.c | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c index 52583a235330..dfd0044cc15a 100644 --- a/drivers/usb/gadget/f_mass_storage.c +++ b/drivers/usb/gadget/f_mass_storage.c @@ -639,7 +639,8 @@ static int fsg_setup(struct usb_function *f, if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) break; - if (w_index != fsg->interface_number || w_value != 0) + if (w_index != fsg->interface_number || w_value != 0 || + w_length != 1) return -EDOM; VDBG(fsg, "get max LUN\n"); *(u8 *)req->buf = fsg->common->nluns - 1; diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c index f7e39b0365ce..4314cf201420 100644 --- a/drivers/usb/gadget/file_storage.c +++ b/drivers/usb/gadget/file_storage.c @@ -875,7 +875,7 @@ static int class_setup_req(struct fsg_dev *fsg, if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) break; - if (w_index != 0 || w_value != 0) { + if (w_index != 0 || w_value != 0 || w_length != 1) { value = -EDOM; break; } |
