evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "USB: f_accessory: Check for length before updating accessory string"

Browse source
This commit is contained in:
Linux Build Service Account 2017-07-21 11:08:22 -07:00 • committed by Gerrit - the friendly Code Review server
commit 2221afb10d
1 changed files with 19 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
drivers/usb/gadget/function/f_accessory.c
View file

@ -346,6 +346,7 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req)
struct acc_dev *dev = ep->driver_data;
char *string_dest = NULL;
int length = req->actual;
unsigned long flags;
if (req->status != 0) {
pr_err("acc_complete_set_string, err %d\n", req->status);
@ -371,22 +372,26 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req)
case ACCESSORY_STRING_SERIAL:
string_dest = dev->serial;
break;
}
if (string_dest) {
unsigned long flags;
if (length >= ACC_STRING_SIZE)
length = ACC_STRING_SIZE - 1;
spin_lock_irqsave(&dev->lock, flags);
memcpy(string_dest, req->buf, length);
/* ensure zero termination */
string_dest[length] = 0;
spin_unlock_irqrestore(&dev->lock, flags);
} else {
default:
pr_err("unknown accessory string index %d\n",
dev->string_index);
dev->string_index);
return;
}
if (!length) {
pr_debug("zero length for accessory string index %d\n",
dev->string_index);
return;
}
if (length >= ACC_STRING_SIZE)
length = ACC_STRING_SIZE - 1;
spin_lock_irqsave(&dev->lock, flags);
memcpy(string_dest, req->buf, length);
/* ensure zero termination */
string_dest[length] = 0;
spin_unlock_irqrestore(&dev->lock, flags);
}
static void acc_complete_set_hid_report_desc(struct usb_ep *ep,