summaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorPaul Zimmerman <Paul.Zimmerman@synopsys.com>2011-10-26 23:07:54 +0400
committerGreg Kroah-Hartman <gregkh@suse.de>2011-11-14 23:51:24 +0400
commitce7b6121851c72d661134d113a78161095e0ae73 (patch)
treeab4ad1d1fb8af3e722b30904ddbc80daa14170c1 /drivers/usb
parentdb332bc9b26bbd79a37241721cccc9919489d5a9 (diff)
downloadlinux-ce7b6121851c72d661134d113a78161095e0ae73.tar.xz
usb: gadget: storage: check for valid USB_BULK_RESET_REQUEST wLength
The USB-IF CV compliance tester is getting stricter, and it would be valid for it to fail a mass-storage device that accepts an invalid USB_BULK_RESET_REQUEST request. Although it doesn't do that yet, let's be proactive and fix that now. Suggested by Alan Stern. Signed-off-by: Paul Zimmerman <paulz@synopsys.com> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/gadget/f_mass_storage.c3
-rw-r--r--drivers/usb/gadget/file_storage.c2
2 files changed, 3 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index dfd0044cc15a..c39d58860fa0 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -624,7 +624,8 @@ static int fsg_setup(struct usb_function *f,
if (ctrl->bRequestType !=
(USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
break;
- if (w_index != fsg->interface_number || w_value != 0)
+ if (w_index != fsg->interface_number || w_value != 0 ||
+ w_length != 0)
return -EDOM;
/*
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 4314cf201420..11b5196284ae 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -859,7 +859,7 @@ static int class_setup_req(struct fsg_dev *fsg,
if (ctrl->bRequestType != (USB_DIR_OUT |
USB_TYPE_CLASS | USB_RECIP_INTERFACE))
break;
- if (w_index != 0 || w_value != 0) {
+ if (w_index != 0 || w_value != 0 || w_length != 0) {
value = -EDOM;
break;
}