xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request

Browse Source 
Prevents mishandling USB requests that are no longer present.

Bug: 161010552
Fixes: 483cb5629e ("ANDROID: usb: gadget: f_accessory: Add Android Accessory function")
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8ff24d6d49214c3bd10a1b5d5e72814ec2a91c61
This commit is contained in:
Lee Jones
2021-11-25 11:52:14 +00:00
parent 376046be3b
commit 575a552ac7
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/usb/gadget/function/f_accessory.c
View File

@@ -678,8 +678,11 @@ fail:
pr_err("acc_bind() could not allocate requests\n"); pr_err("acc_bind() could not allocate requests\n");
while ((req = req_get(dev, &dev->tx_idle))) while ((req = req_get(dev, &dev->tx_idle)))
acc_request_free(req, dev->ep_in); acc_request_free(req, dev->ep_in);
for (i = 0; i < RX_REQ_MAX; i++) for (i = 0; i < RX_REQ_MAX; i++) {
acc_request_free(dev->rx_req[i], dev->ep_out); acc_request_free(dev->rx_req[i], dev->ep_out);
dev->rx_req[i] = NULL;
}
return -1; return -1;
} }
@@ -711,6 +714,12 @@ static ssize_t acc_read(struct file *fp, char __user *buf,
goto done; goto done;
} }
if (!dev->rx_req[0]) {
pr_warn("acc_read: USB request already handled/freed");
r = -EINVAL;
goto done;
}
/* /*
* Calculate the data length by considering termination character. * Calculate the data length by considering termination character.
* Then compansite the difference of rounding up to * Then compansite the difference of rounding up to
@@ -1187,8 +1196,10 @@ acc_function_unbind(struct usb_configuration *c, struct usb_function *f)
while ((req = req_get(dev, &dev->tx_idle))) while ((req = req_get(dev, &dev->tx_idle)))
acc_request_free(req, dev->ep_in); acc_request_free(req, dev->ep_in);
for (i = 0; i < RX_REQ_MAX; i++) for (i = 0; i < RX_REQ_MAX; i++) {
acc_request_free(dev->rx_req[i], dev->ep_out); acc_request_free(dev->rx_req[i], dev->ep_out);
dev->rx_req[i] = NULL;
}
acc_hid_unbind(dev); acc_hid_unbind(dev);
} }