diff options
| author |   Ingo Molnar <mingo@kernel.org> | 2021-12-13 10:48:46 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2021-12-13 10:48:46 +0100 |
| commit | 6773cc31a9bb5122fd5c288f73ca006ad20a6c17 (patch) | |
| tree | 730ec8bcc0a5ddd5030268bb3ffd4945d34728c1 /drivers/usb/gadget/legacy/inode.c | |
| parent | futex: Fix additional regressions (diff) | |
| parent | Linux 5.16-rc5 (diff) | |
| download | wireguard-linux-6773cc31a9bb5122fd5c288f73ca006ad20a6c17.tar.xz wireguard-linux-6773cc31a9bb5122fd5c288f73ca006ad20a6c17.zip | |
Merge tag 'v5.16-rc5' into locking/core, to pick up fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/usb/gadget/legacy/inode.c')
| -rw-r--r-- | drivers/usb/gadget/legacy/inode.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index 78be94750232..63150e3889ef 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -110,6 +110,8 @@ enum ep0_state { /* enough for the whole queue: most events invalidate others */ #define N_EVENT 5 +#define RBUF_SIZE 256 + struct dev_data { spinlock_t lock; refcount_t count; @@ -144,7 +146,7 @@ struct dev_data { struct dentry *dentry; /* except this scratch i/o buffer for ep0 */ - u8 rbuf [256]; + u8 rbuf[RBUF_SIZE]; }; static inline void get_dev (struct dev_data *data) @@ -1331,6 +1333,18 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) u16 w_value = le16_to_cpu(ctrl->wValue); u16 w_length = le16_to_cpu(ctrl->wLength); + if (w_length > RBUF_SIZE) { + if (ctrl->bRequestType == USB_DIR_OUT) { + return value; + } else { + /* Cast away the const, we are going to overwrite on purpose. */ + __le16 *temp = (__le16 *)&ctrl->wLength; + + *temp = cpu_to_le16(RBUF_SIZE); + w_length = RBUF_SIZE; + } + } + spin_lock (&dev->lock); dev->setup_abort = 0; if (dev->state == STATE_DEV_UNCONNECTED) { |