On Thu, Jan 13, 2011 at 6:47 PM, David Brownell <david-b@xxxxxxxxxxx> wrote:
> Seems like a clear and new-ish bug (regression, as
> I thought MSC tests had been run before).
>
David,
I have tried to align with the way other cases in composite_setup()
handle this while fixing this.
Alan's comments are welcome.
Regards,
Maulik
> Alan, do you think you could make a bit of time to
> review this fix to see if it can be bettered?
> (My first reaction is that this catches the bug
> pretty late ... but also, LUN handling isn't a
> thing I know much about.
>
>> Get Max LUN request with
>> invalid wIndex (wIndex = 65535) parameter.
>>
>> Add proper handling to prevent array index out of bounds
>> issue.
>>
>> Signed-off-by: Maulik Mankad <maulik@xxxxxx>
>> Cc: David Brownell <david-b@xxxxxxxxxxx>
>> Cc: Greg Kroah-Hartman <gregkh@xxxxxxx>
>> ---
>> Tested on OMAP4 SDP.
>> drivers/usb/gadget/composite.c | 5 +++--
>> 1 files changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/usb/gadget/composite.c
>> b/drivers/usb/gadget/composite.c
>> index f6ff845..1ba4bef 100644
>> --- a/drivers/usb/gadget/composite.c
>> +++ b/drivers/usb/gadget/composite.c
>> @@ -928,8 +928,9 @@ unknown:
>> */
>> switch
>> (ctrl->bRequestType & USB_RECIP_MASK) {
>> case
>> USB_RECIP_INTERFACE:
>> -
>> if (cdev->config)
>> -
>> f = cdev->config->interface[intf];
>> +
>> if (!cdev->config || w_index >=
>> MAX_CONFIG_INTERFACES)
>> +
>> break;
>> + f
>> = cdev->config->interface[intf];
>>
>> break;
>>
>> case
>> USB_RECIP_ENDPOINT:
>> --
>> 1.6.0.4
>>
>>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
