diff options
| author | Paul Zimmerman <Paul.Zimmerman@synopsys.com> | 2011-10-13 17:46:36 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-11-14 11:51:24 -0800 |
| commit | db332bc9b26bbd79a37241721cccc9919489d5a9 (patch) | |
| tree | 37e48041f7e0eb2f53bedf186e6a633bd546b6d0 /drivers/usb/gadget/f_mass_storage.c | |
| parent | b7a8d17db9a86db1040862600cf3a02848f83844 (diff) | |
| download | lwn-db332bc9b26bbd79a37241721cccc9919489d5a9.tar.gz lwn-db332bc9b26bbd79a37241721cccc9919489d5a9.zip | |
usb: gadget: storage: check for valid USB_BULK_GET_MAX_LUN_REQUEST
The latest USB-IF CV tester checks for a valid length for this
request.
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/gadget/f_mass_storage.c')
| -rw-r--r-- | drivers/usb/gadget/f_mass_storage.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c index 52583a235330..dfd0044cc15a 100644 --- a/drivers/usb/gadget/f_mass_storage.c +++ b/drivers/usb/gadget/f_mass_storage.c @@ -639,7 +639,8 @@ static int fsg_setup(struct usb_function *f, if (ctrl->bRequestType != (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE)) break; - if (w_index != fsg->interface_number || w_value != 0) + if (w_index != fsg->interface_number || w_value != 0 || + w_length != 1) return -EDOM; VDBG(fsg, "get max LUN\n"); *(u8 *)req->buf = fsg->common->nluns - 1; |