usb: gadget: f_fs: Fix kernel panic if use_os_string not set
PATCH 1/1 usb: gadget: f_fs: Fix kernel panic if use_os_string not set
If c->cdev->use_os_string flag is not set,
don't need to invoke ffs_do_os_descs() in _ffs_func_bind. So uninitialized ext_compat_id pointer won't be accessed by __ffs_func_bind_do_os_desc to cause kernel panic.
Signed-off-by Jim Lin <[email protected]>
--- drivers/usb/gadget/function/f_fs.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/usb/gadget/function/f_fs.c +10 -8
@@ -2851,7 +2851,7 @@ static int _ffs_func_bind(struct usb_configuration *c, goto error; func->function.os_desc_table =vla_ptr (vlabuf, d, os_desc_table); -if (c->cdev->use_os_string) +if (c->cdev->use_os_string) {for (i =0 ; i < ffs->interfaces_count; ++i) {struct usb_os_desc *desc;
@@ -2862,13 +2862,15 @@ static int _ffs_func_bind(struct usb_configuration *c,vla_ptr (vlabuf, d, ext_compat) + i *16 ;INIT_LIST_HEAD (&desc->ext_prop); } - ret =ffs_do_os_descs (ffs->ms_os_descs_count, -vla_ptr (vlabuf, d, raw_descs) + - fs_len + hs_len + ss_len, - d_raw_descs__sz - fs_len - hs_len - ss_len, - __ffs_func_bind_do_os_desc, func); -if (unlikely (ret <0 )) - goto error; + ret =ffs_do_os_descs (ffs->ms_os_descs_count, +vla_ptr (vlabuf, d, raw_descs) + + fs_len + hs_len + ss_len, + d_raw_descs__sz - fs_len - hs_len - + ss_len, + __ffs_func_bind_do_os_desc, func); +if (unlikely (ret <0 )) + goto error; + } func->function.os_desc_n = c->cdev->use_os_string ? ffs->interfaces_count :0 ;
Signature · 1 line
1.9.1