Hi, sorry, pls ping
On 12.03.2025 10:53, Arseniy Krasnov wrote:
> Hi, sorry, pls ping
>
> On 03.02.2025 18:55, Vladimir Mitrofanov wrote:
>> Some proprietary protocols uses "w_index" field not by the rules.
>> When we set "intf = w_index & 0xFF" variable without check it may
>> exceed maximum number of interfaces. Not all code cases below check
>> the range of this variable. In some protocols it is usefull to
>> guaranty that "intf" not exceed MAX_CONFIG_INTERFACES.
>>
>> Fixes: 7010f5b94fa3 ("usb:gadget:composite USB composite gadget support")
>> Signed-off-by: Vladimir Mitrofanov <[email protected]>
>> ---
>> drivers/usb/gadget/composite.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
>> index 04b8541993..4bb2afa833 100644
>> --- a/drivers/usb/gadget/composite.c
>> +++ b/drivers/usb/gadget/composite.c
>> @@ -1011,7 +1011,7 @@ composite_setup(struct usb_gadget *gadget, const
>> struct usb_ctrlrequest *ctrl)
>> u16 w_index = le16_to_cpu(ctrl->wIndex);
>> u16 w_value = le16_to_cpu(ctrl->wValue);
>> struct usb_composite_dev *cdev = get_gadget_data(gadget);
>> - u8 intf = w_index & 0xFF;
>> + u8 intf = min_t(u8, w_index & 0xFF,
>> MAX_CONFIG_INTERFACES - 1);
>> int value = -EOPNOTSUPP;
>> struct usb_request *req = cdev->req;
>> struct usb_function *f = NULL;
