Skip to contentSkip to conversation

usb: gadget: composite: fix NULL pointer when a non standard request is received

PATCH New patrice.chotard at st.com 3 participants 5 messages Mar 15, 2018 – Apr 27, 2018 USB

lore
Share & tools
lore

patrice.chotard at st.com

author
#0 lore raw

PATCH 1/1 usb: gadget: composite: fix NULL pointer when a non standard request is received

From: Christophe Kerello <[email protected]>

In case usb configuration is unknown (cdev->config == NULL), non standard request should not be processed.
Remove also the cdev->config check below which will never happen.

This issue was seen using ums feature.

Signed-off-by Christophe Kerello <[email protected]>
Signed-off-by Patrice Chotard <[email protected]>
---
 drivers/usb/gadget/composite.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/composite.c +4 -1
index d0ee7847b98d..a87639def974 100644
@@ -838,6 +838,9 @@ unknown:
 			ctrl->bRequestType, ctrl->bRequest,
 			w_value, w_index, w_length);
 
+		if (!cdev->config)
+			goto done;
+
 		/*
 		 * functions always handle their interfaces and endpoints...
 		 * punt other recipients (other, WUSB, ...) to the current

@@ -882,7 +885,7 @@ unknown:
 			value = f->setup(f, ctrl);
 		else {
 			c = cdev->config;
-			if (c && c->setup)
+			if (c->setup)
 				value = c->setup(c, ctrl);
 		}
Signature · 1 line
1.9.1
author
#1 lore raw

PATCH 1/1 usb: gadget: composite: fix NULL pointer when a non standard request is received

Hi

It's a gentle reminder as this patch is present on mailing list since 5 weeks without any feedback.

Thanks

Quoted 38 lines · patrice.chotard at st.com

From: Christophe Kerello <[email protected]>

In case usb configuration is unknown (cdev->config == NULL), non standard request should not be processed.
Remove also the cdev->config check below which will never happen.

This issue was seen using ums feature.

Signed-off-by Christophe Kerello <[email protected]>
Signed-off-by Patrice Chotard <[email protected]>
---
  drivers/usb/gadget/composite.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/composite.c +4 -1
index d0ee7847b98d..a87639def974 100644
@@ -838,6 +838,9 @@ unknown:
  			ctrl->bRequestType, ctrl->bRequest,
  			w_value, w_index, w_length);
 
+		if (!cdev->config)
+			goto done;
+
  		/*
  		 * functions always handle their interfaces and endpoints...
  		 * punt other recipients (other, WUSB, ...) to the current

@@ -882,7 +885,7 @@ unknown:
  			value = f->setup(f, ctrl);
  		else {
  			c = cdev->config;
-			if (c && c->setup)
+			if (c->setup)
  				value = c->setup(c, ctrl);
  		}
Applied
#2 lore raw

PATCH 1/1 usb: gadget: composite: fix NULL pointer when a non standard request is received

Quoted 4 lines · Patrice CHOTARD

Hi

It's a gentle reminder as this patch is present on mailing list since 5 weeks without any feedback.

This should've been like a third non-gentle ping, seriously, two weeks without feedback is already sucky. Time to buzz Lukasz, although he is probably busy with personal stuff these days.

Applied

Quoted 40 lines

Thanks

Quoted 37 lines · patrice.chotard at st.com

From: Christophe Kerello <[email protected]>

In case usb configuration is unknown (cdev->config == NULL), non standard request should not be processed.
Remove also the cdev->config check below which will never happen.

This issue was seen using ums feature.

Signed-off-by Christophe Kerello <[email protected]>
Signed-off-by Patrice Chotard <[email protected]>
---
  drivers/usb/gadget/composite.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/composite.c +4 -1
index d0ee7847b98d..a87639def974 100644
@@ -838,6 +838,9 @@ unknown:
  			ctrl->bRequestType, ctrl->bRequest,
  			w_value, w_index, w_length);
 
+		if (!cdev->config)
+			goto done;
+
  		/*
  		 * functions always handle their interfaces and endpoints...
  		 * punt other recipients (other, WUSB, ...) to the current

@@ -882,7 +885,7 @@ unknown:
  			value = f->setup(f, ctrl);
  		else {
  			c = cdev->config;
-			if (c && c->setup)
+			if (c->setup)
  				value = c->setup(c, ctrl);
  		}
Signature · 2 lines
Best regards,
Marek Vasut
#3 lore raw

PATCH 1/1 usb: gadget: composite: fix NULL pointer when a non standard request is received

In reply to Patrice CHOTARD

Hi Patrice,

Quoted 4 lines

Hi

It's a gentle reminder as this patch is present on mailing list since 5 weeks without any feedback.

Deepest apologizes for the delay.

I will test this patch - as some Samsung SoCs may use this feature and let you know.

Quoted 35 lines

Thanks

Quoted 31 lines · patrice.chotard at st.com

From: Christophe Kerello <[email protected]>

In case usb configuration is unknown (cdev->config == NULL), non standard request should not be processed.
Remove also the cdev->config check below which will never happen.

This issue was seen using ums feature.

Signed-off-by Christophe Kerello <[email protected]>
Signed-off-by Patrice Chotard <[email protected]>
---
  drivers/usb/gadget/composite.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)
(quoted diff) +0 -0

b/drivers/usb/gadget/composite.c index d0ee7847b98d..a87639def974 100644 --- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c

drivers/usb/gadget/composite.c +3 -0
@@ -838,6 +838,9 @@ unknown:
  			ctrl->bRequestType, ctrl->bRequest,
  			w_value, w_index, w_length);
 
+		if (!cdev->config)
+			goto done;
+
  		/*
  		 * functions always handle their interfaces and

endpoints...
* punt other recipients (other, WUSB, ...) to
the current @@ -882,7 +885,7 @@ unknown:
value = f->setup(f, ctrl);

Quoted 8 lines

drivers/usb/gadget/composite.c unknown: · line 890

Quoted 8 lines
  		else {
  			c = cdev->config;
drivers/usb/gadget/composite.c +1 -1
-			if (c && c->setup)
+			if (c->setup)
  				value = c->setup(c, ctrl);
  		}

Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de -------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180426/90311f33/attachment.sig>

author
#4 lore raw

PATCH 1/1 usb: gadget: composite: fix NULL pointer when a non standard request is received

Thanks Lukasz ;-)

Quoted 69 lines · Lukasz Majewski

Hi Patrice,

Quoted 4 lines

Hi

It's a gentle reminder as this patch is present on mailing list since 5 weeks without any feedback.

Deepest apologizes for the delay.

I will test this patch - as some Samsung SoCs may use this feature and let you know.

Quoted 35 lines

Thanks

Quoted 31 lines · patrice.chotard at st.com

From: Christophe Kerello <[email protected]>

In case usb configuration is unknown (cdev->config == NULL), non standard request should not be processed.
Remove also the cdev->config check below which will never happen.

This issue was seen using ums feature.

Signed-off-by Christophe Kerello <[email protected]>
Signed-off-by Patrice Chotard <[email protected]>
---
   drivers/usb/gadget/composite.c | 5 ++++-
   1 file changed, 4 insertions(+), 1 deletion(-)
(quoted diff) +0 -0

b/drivers/usb/gadget/composite.c index d0ee7847b98d..a87639def974 100644 --- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c

drivers/usb/gadget/composite.c +3 -0
@@ -838,6 +838,9 @@ unknown:
   			ctrl->bRequestType, ctrl->bRequest,
   			w_value, w_index, w_length);
 
+		if (!cdev->config)
+			goto done;
+
   		/*
   		 * functions always handle their interfaces and

endpoints...
* punt other recipients (other, WUSB, ...) to
the current @@ -882,7 +885,7 @@ unknown:

   			value = f->setup(f, ctrl);
Quoted 8 lines

drivers/usb/gadget/composite.c unknown: · line 890

Quoted 8 lines
   		else {
   			c = cdev->config;
drivers/usb/gadget/composite.c +1 -1
-			if (c && c->setup)
+			if (c->setup)
   				value = c->setup(c, ctrl);
   		}

Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de