From: Bryan Wu <cooloney@kernel.org>
To: gregkh@suse.de
Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
Bryan Wu <cooloney@kernel.org>
Subject: [PATCH 2/2] usb: composite: Fix bug: low byte of w_index is the usb interface number not the whole 2 bytes of w_index
Date: Thu, 8 Jan 2009 00:21:19 +0800 [thread overview]
Message-ID: <1231345279-26618-3-git-send-email-cooloney@kernel.org> (raw)
In-Reply-To: <1231345279-26618-1-git-send-email-cooloney@kernel.org>
In some usb gadget driver, for example usb audio class device, the high
byte of w_index is the entity id and low byte is the interface number.
If we use the 2 bytes of w_index as the array number, we will get a
wrong pointer or NULL pointer.
This patch fixes this issue.
Signed-off-by: Bryan Wu <cooloney@kernel.org>
---
drivers/usb/gadget/composite.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 363951e..5d11c29 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -683,6 +683,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
struct usb_request *req = cdev->req;
int value = -EOPNOTSUPP;
u16 w_index = le16_to_cpu(ctrl->wIndex);
+ u8 intf = w_index & 0xFF;
u16 w_value = le16_to_cpu(ctrl->wValue);
u16 w_length = le16_to_cpu(ctrl->wLength);
struct usb_function *f = NULL;
@@ -769,7 +770,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
goto unknown;
if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
break;
- f = cdev->config->interface[w_index];
+ f = cdev->config->interface[intf];
if (!f)
break;
if (w_value && !f->set_alt)
@@ -781,7 +782,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
goto unknown;
if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
break;
- f = cdev->config->interface[w_index];
+ f = cdev->config->interface[intf];
if (!f)
break;
/* lots of interfaces only need altsetting zero... */
@@ -808,7 +809,7 @@ unknown:
*/
if ((ctrl->bRequestType & USB_RECIP_MASK)
== USB_RECIP_INTERFACE) {
- f = cdev->config->interface[w_index];
+ f = cdev->config->interface[intf];
if (f && f->setup)
value = f->setup(f, ctrl);
else
--
1.5.6
next prev parent reply other threads:[~2009-01-07 16:21 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-07 16:21 [PATCH 0/2] Bugs fixing for USB composite gadget driver Bryan Wu
2009-01-07 16:21 ` [PATCH 1/2] usb: composite: Fix bug: should test set_alt function pointer before use it Bryan Wu
2009-01-24 5:59 ` David Brownell
2009-01-07 16:21 ` Bryan Wu [this message]
2009-01-24 6:00 ` [PATCH 2/2] usb: composite: Fix bug: low byte of w_index is the usb interface number not the whole 2 bytes of w_index David Brownell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1231345279-26618-3-git-send-email-cooloney@kernel.org \
--to=cooloney@kernel.org \
--cc=gregkh@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox