usb: gadget: composite: pass the validated interface index
Subsystems (2)
PATCH 1/1 usb: gadget: composite: pass the validated interface index
composite_setup() validates the low byte of wIndex as an interface number, but passes the full 16-bit wIndex to the function's get_alt and set_alt callbacks. FunctionFS reverse-maps the low byte and then uses the original callback argument to index its fixed-size cur_alt array.
Pass the decoded and validated interface number to the callbacks. This matches the callback contract and prevents an out-of-bounds cur_alt access when the high byte of wIndex is nonzero.
Fixes 2f550553e23c ("usb: gadget: f_fs: Add the missing get_alt callback")
Reported-by Chris Mason <[email protected]>
Signed-off-by Aldo Ariel Panzardo <[email protected]>
--- drivers/usb/gadget/composite.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/gadget/composite.c +2 -2
@@ -1930,7 +1930,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)break ;spin_lock (&cdev->lock); - value = f->set_alt (f, w_index, w_value); + value = f->set_alt (f, intf, w_value);if (value ==USB_GADGET_DELAYED_STATUS ) { DBG(cdev, "%s: interface %d (%s) requested delayed status\n",
@@ -1950,7 +1950,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)if (!f)break ;/* lots of interfaces only need altsetting zero... */ - value = f->get_alt ? f->get_alt (f, w_index) :0 ; + value = f->get_alt ? f->get_alt (f, intf) :0 ;if (value <0 )break ; *((u8 *)req->buf) = value;
Signature · 1 line
2.43.0