--- On Thu, 1/13/11, Maulik Mankad <maulik@xxxxxx> wrote:
> From: Maulik Mankad <maulik@xxxxxx>
> Subject: [PATCH] usb: gadget: composite: avoid access beyond array max length
> To: linux-usb@xxxxxxxxxxxxxxx
> Cc: "Maulik Mankad" <maulik@xxxxxx>, "David Brownell" <david-b@xxxxxxxxxxx>, "Greg Kroah-Hartman" <gregkh@xxxxxxx>
> Date: Thursday, January 13, 2011, 4:49 AM
> One of the USB CV MSC tests issues
Seems like a clear and new-ish bug (regression, as
I thought MSC tests had been run before).
Alan, do you think you could make a bit of time to
review this fix to see if it can be bettered?
(My first reaction is that this catches the bug
pretty late ... but also, LUN handling isn't a
thing I know much about.
> Get Max LUN request with
> invalid wIndex (wIndex = 65535) parameter.
>
> Add proper handling to prevent array index out of bounds
> issue.
>
> Signed-off-by: Maulik Mankad <maulik@xxxxxx>
> Cc: David Brownell <david-b@xxxxxxxxxxx>
> Cc: Greg Kroah-Hartman <gregkh@xxxxxxx>
> ---
> Tested on OMAP4 SDP.
> drivers/usb/gadget/composite.c | 5 +++--
> 1 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/composite.c
> b/drivers/usb/gadget/composite.c
> index f6ff845..1ba4bef 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -928,8 +928,9 @@ unknown:
> */
> switch
> (ctrl->bRequestType & USB_RECIP_MASK) {
> case
> USB_RECIP_INTERFACE:
> -
> if (cdev->config)
> -
> f = cdev->config->interface[intf];
> +
> if (!cdev->config || w_index >=
> MAX_CONFIG_INTERFACES)
> +
> break;
> + f
> = cdev->config->interface[intf];
>
> break;
>
> case
> USB_RECIP_ENDPOINT:
> --
> 1.6.0.4
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
