evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: gadget: composite: Handle OS descriptor request properly

Browse source 
In case w_index or w_value of an OS descriptor does not match
for a device or an interface, value remains set to -EOPNOTSUPP.
This is assigned to an unsigned request length and becomes a
large integer value. When driver tries to allocate a buffer
of this large integer value DMA allocator complaints for out of
SW-IOMMU space. Hence check this variable for negative value and
return without queuing ep0 request.

CRs-Fixed: 1013316
Change-Id: I705d0d54fb17ca3042533f0106f91912215bd52a
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
This commit is contained in:
Hemant Kumar 2016-05-04 19:30:23 -07:00 • committed by Jeevan Shriram
parent 6f856046e0
commit b3a6d13c13
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/usb/gadget/composite.c
View file

@ -1912,6 +1912,16 @@ unknown:
}
break;
}
if (value < 0) {
DBG(cdev, "%s: unhandled os desc request\n",
__func__);
DBG(cdev, "req%02x.%02x v%04x i%04x l%d\n",
ctrl->bRequestType, ctrl->bRequest,
w_value, w_index, w_length);
return value;
}
req->length = value;
req->context = cdev;
req->zero = value < w_length;