diff options
author | Ingo Molnar <mingo@kernel.org> | 2021-12-13 10:48:46 +0100 |
---|---|---|
committer | Ingo Molnar <mingo@kernel.org> | 2021-12-13 10:48:46 +0100 |
commit | 6773cc31a9bb5122fd5c288f73ca006ad20a6c17 (patch) | |
tree | 730ec8bcc0a5ddd5030268bb3ffd4945d34728c1 /drivers/usb/gadget/legacy/dbgp.c | |
parent | futex: Fix additional regressions (diff) | |
parent | Linux 5.16-rc5 (diff) | |
download | linux-dev-6773cc31a9bb5122fd5c288f73ca006ad20a6c17.tar.xz linux-dev-6773cc31a9bb5122fd5c288f73ca006ad20a6c17.zip |
Merge tag 'v5.16-rc5' into locking/core, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/usb/gadget/legacy/dbgp.c')
-rw-r--r-- | drivers/usb/gadget/legacy/dbgp.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c index e1d566c9918a..355bc7dab9d5 100644 --- a/drivers/usb/gadget/legacy/dbgp.c +++ b/drivers/usb/gadget/legacy/dbgp.c @@ -137,7 +137,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep) goto fail_1; } - req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL); + req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL); if (!req->buf) { err = -ENOMEM; stp = 2; @@ -345,6 +345,19 @@ static int dbgp_setup(struct usb_gadget *gadget, void *data = NULL; u16 len = 0; + if (length > DBGP_REQ_LEN) { + if (ctrl->bRequestType == USB_DIR_OUT) { + return err; + } else { + /* Cast away the const, we are going to overwrite on purpose. */ + __le16 *temp = (__le16 *)&ctrl->wLength; + + *temp = cpu_to_le16(DBGP_REQ_LEN); + length = DBGP_REQ_LEN; + } + } + + if (request == USB_REQ_GET_DESCRIPTOR) { switch (value>>8) { case USB_DT_DEVICE: |