[PATCH] usb: gadget: function fs req_match endpoint address fix

[PATCH] usb: gadget: function fs req_match endpoint address fix

[linux-dev]

From: Dean Anderson <linux-dev@sensoray.com>

Fixes f_fs.c handling USB_RECIP_ENDPOINT request types incorrectly for
endpoints not belonging to it. f_fs.c needs to distinguish between IN
and OUT endpoints, not just the endpoint number. Otherwise, f_fs may
handle endpoints belonging to other functions. This occurs in the
gadget/composite.c composite_setup function in the req_match callback.

Signed-off-by: Dean Anderson <linux-dev@sensoray.com>

---
 drivers/usb/gadget/function/f_fs.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 6e9ef35a43a7..61b4abd6a9df 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -71,7 +71,8 @@ struct ffs_function {
 	struct ffs_data			*ffs;
 
 	struct ffs_ep			*eps;
-	u8				eps_revmap[16];
+	u8				eps_revmap_in[16];
+	u8				eps_revmap_out[16];
 	short				*interfaces_nums;
 
 	struct usb_function		function;
@@ -2843,8 +2844,12 @@ static int __ffs_func_bind_do_descs(enum ffs_entity_type type, u8 *valuep,
 
 		ffs_ep->ep  = ep;
 		ffs_ep->req = req;
-		func->eps_revmap[ds->bEndpointAddress &
-				 USB_ENDPOINT_NUMBER_MASK] = idx + 1;
+		if (ds->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+			func->eps_revmap_in[ds->bEndpointAddress &
+					USB_ENDPOINT_NUMBER_MASK] = idx + 1;
+		else
+			func->eps_revmap_out[ds->bEndpointAddress &
+					USB_ENDPOINT_NUMBER_MASK] = idx + 1;
 		/*
 		 * If we use virtual address mapping, we restore
 		 * original bEndpointAddress value.
@@ -3371,7 +3376,8 @@ static void ffs_func_resume(struct usb_function *f)
 
 static int ffs_func_revmap_ep(struct ffs_function *func, u8 num)
 {
-	num = func->eps_revmap[num & USB_ENDPOINT_NUMBER_MASK];
+	num = num & USB_ENDPOINT_DIR_MASK ? func->eps_revmap_in[num & USB_ENDPOINT_NUMBER_MASK]
+		: func->eps_revmap_out[num & USB_ENDPOINT_NUMBER_MASK];
 	return num ? num : -EDOM;
 }
 
-- 
2.30.2

Re: [PATCH] usb: gadget: function fs req_match endpoint address fix

[Greg KH]

On Mon, Oct 09, 2023 at 03:06:56PM -0700, linux-dev@sensoray.com wrote:
> From: Dean Anderson <linux-dev@sensoray.com>
> 
> Fixes f_fs.c handling USB_RECIP_ENDPOINT request types incorrectly for
> endpoints not belonging to it. f_fs.c needs to distinguish between IN
> and OUT endpoints, not just the endpoint number. Otherwise, f_fs may
> handle endpoints belonging to other functions. This occurs in the
> gadget/composite.c composite_setup function in the req_match callback.
> 
> Signed-off-by: Dean Anderson <linux-dev@sensoray.com>
> 
> ---
>  drivers/usb/gadget/function/f_fs.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)

What commit id does this fix?

Re: [PATCH] usb: gadget: function fs req_match endpoint address fix

[dean]

On 2023-10-10 01:00, Greg KH wrote:
> On Mon, Oct 09, 2023 at 03:06:56PM -0700, linux-dev@sensoray.com wrote:
>> From: Dean Anderson <linux-dev@sensoray.com>
>> 
>> Fixes f_fs.c handling USB_RECIP_ENDPOINT request types incorrectly for
>> endpoints not belonging to it. f_fs.c needs to distinguish between IN
>> and OUT endpoints, not just the endpoint number. Otherwise, f_fs may
>> handle endpoints belonging to other functions. This occurs in the
>> gadget/composite.c composite_setup function in the req_match callback.
>> 
>> Signed-off-by: Dean Anderson <linux-dev@sensoray.com>
>> 
>> ---
>>  drivers/usb/gadget/function/f_fs.c | 14 ++++++++++----
>>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> What commit id does this fix?

8a749fd1a8720d4619c91c8b6e7528c0a355c0aa

"git log"

commit df91c8a9c05098f06ad2dd5bf0d9342e80a9eb22 (HEAD -> v6.6-rc4)
Author: Dean A <dean@sensoray.com>
Date:   Mon Oct 9 15:04:19 2023 -0700

     usb: gadget: function fs req_match endpoint address fix

commit 8a749fd1a8720d4619c91c8b6e7528c0a355c0aa (tag: v6.6-rc4)
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Oct 1 14:15:13 2023 -0700

     Linux 6.6-rc4