From b3a6d13c131943e2a5bd629cd669f63eda921a75 Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Wed, 4 May 2016 19:30:23 -0700 Subject: [PATCH] usb: gadget: composite: Handle OS descriptor request properly In case w_index or w_value of an OS descriptor does not match for a device or an interface, value remains set to -EOPNOTSUPP. This is assigned to an unsigned request length and becomes a large integer value. When driver tries to allocate a buffer of this large integer value DMA allocator complaints for out of SW-IOMMU space. Hence check this variable for negative value and return without queuing ep0 request. CRs-Fixed: 1013316 Change-Id: I705d0d54fb17ca3042533f0106f91912215bd52a Signed-off-by: Hemant Kumar --- drivers/usb/gadget/composite.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 67aa070effe4..e2049464af11 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1912,6 +1912,16 @@ unknown: } break; } + + if (value < 0) { + DBG(cdev, "%s: unhandled os desc request\n", + __func__); + DBG(cdev, "req%02x.%02x v%04x i%04x l%d\n", + ctrl->bRequestType, ctrl->bRequest, + w_value, w_index, w_length); + return value; + } + req->length = value; req->context = cdev; req->zero = value < w_length;