diff options
| author | Paul Zimmerman <Paul.Zimmerman@synopsys.com> | 2011-10-26 19:07:54 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-14 19:51:24 (GMT) |
| commit | ce7b6121851c72d661134d113a78161095e0ae73 (patch) | |
| tree | ab4ad1d1fb8af3e722b30904ddbc80daa14170c1 /drivers/usb | |
| parent | db332bc9b26bbd79a37241721cccc9919489d5a9 (diff) | |
| download | linux-ce7b6121851c72d661134d113a78161095e0ae73.tar.xz | |
usb: gadget: storage: check for valid USB_BULK_RESET_REQUEST wLength
The USB-IF CV compliance tester is getting stricter, and it would
be valid for it to fail a mass-storage device that accepts an
invalid USB_BULK_RESET_REQUEST request. Although it doesn't do
that yet, let's be proactive and fix that now.
Suggested by Alan Stern.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/f_mass_storage.c | 3 | ||||
| -rw-r--r-- | drivers/usb/gadget/file_storage.c | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c index dfd0044..c39d588 100644 --- a/drivers/usb/gadget/f_mass_storage.c +++ b/drivers/usb/gadget/f_mass_storage.c @@ -624,7 +624,8 @@ static int fsg_setup(struct usb_function *f, if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) break; - if (w_index != fsg->interface_number || w_value != 0) + if (w_index != fsg->interface_number || w_value != 0 || + w_length != 0) return -EDOM; /* diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c index 4314cf2..11b5196 100644 --- a/drivers/usb/gadget/file_storage.c +++ b/drivers/usb/gadget/file_storage.c @@ -859,7 +859,7 @@ static int class_setup_req(struct fsg_dev *fsg, if (ctrl->bRequestType != (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) break; - if (w_index != 0 || w_value != 0) { + if (w_index != 0 || w_value != 0 || w_length != 0) { value = -EDOM; break; } |