evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USB: f_accessory: Check for length before updating accessory string

Browse source 
It is possible that host sends SEND_STRING control request with zero
length and in that case, driver ends up setting string as NULL. This
results in CTS failure for accessory test. Hence add check for length
and update string only if length is nonzero.

Change-Id: I4594a46f830f45fc49f80a74ec6042383edf007d
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
This commit is contained in:
Vijayavardhan Vennapusa 2017-07-14 16:47:10 +05:30
parent bc399a65c4
commit a5eddc1f77
1 changed files with 19 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
drivers/usb/gadget/function/f_accessory.c
View file

@ -346,6 +346,7 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req)
struct acc_dev *dev = ep->driver_data;
char *string_dest = NULL;
int length = req->actual;
unsigned long flags;
if (req->status != 0) {
pr_err("acc_complete_set_string, err %d\n", req->status);
@ -371,22 +372,26 @@ static void acc_complete_set_string(struct usb_ep *ep, struct usb_request *req)
case ACCESSORY_STRING_SERIAL:
string_dest = dev->serial;
break;
}
if (string_dest) {
unsigned long flags;
if (length >= ACC_STRING_SIZE)
length = ACC_STRING_SIZE - 1;
spin_lock_irqsave(&dev->lock, flags);
memcpy(string_dest, req->buf, length);
/* ensure zero termination */
string_dest[length] = 0;
spin_unlock_irqrestore(&dev->lock, flags);
} else {
default:
pr_err("unknown accessory string index %d\n",
dev->string_index);
dev->string_index);
return;
}
if (!length) {
pr_debug("zero length for accessory string index %d\n",
dev->string_index);
return;
}
if (length >= ACC_STRING_SIZE)
length = ACC_STRING_SIZE - 1;
spin_lock_irqsave(&dev->lock, flags);
memcpy(string_dest, req->buf, length);
/* ensure zero termination */
string_dest[length] = 0;
spin_unlock_irqrestore(&dev->lock, flags);
}
static void acc_complete_set_hid_report_desc(struct usb_ep *ep,