1. 13 Mar, 2018 38 commits
  2. 08 Mar, 2018 2 commits
    • Chris Dickens's avatar
      usb: gadget: composite: remove duplicated code in OS desc handling · 636ba13a
      Chris Dickens authored
      When the host wants to fetch OS descriptors, it sends two requests. The
      first is only for the header and the second for the full amount
      specified by the header in the first request. The OS descriptor handling
      code is distinguishing the header-only requests based on the wLength of
      the setup packet, but the same code is executed in both cases to
      construct the actual header. Simplify this by always constructing the
      header and then filling out the rest of the request if the wLength is
      greater than the size of the header.
      
      Also remove the duplicate code for queueing the request to ep0 by adding
      a goto label.
      Signed-off-by: default avatarChris Dickens <christopher.a.dickens@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      636ba13a
    • Chris Dickens's avatar
      usb: gadget: composite: fix incorrect handling of OS desc requests · 5d6ae4f0
      Chris Dickens authored
      When handling an OS descriptor request, one of the first operations is
      to zero out the request buffer using the wLength from the setup packet.
      There is no bounds checking, so a wLength > 4096 would clobber memory
      adjacent to the request buffer. Fix this by taking the min of wLength
      and the request buffer length prior to the memset. While at it, define
      the buffer length in a header file so that magic numbers don't appear
      throughout the code.
      
      When returning data to the host, the data length should be the min of
      the wLength and the valid data we have to return. Currently we are
      returning wLength, thus requests for a wLength greater than the amount
      of data in the OS descriptor buffer would return invalid (albeit zero'd)
      data following the valid descriptor data. Fix this by counting the
      number of bytes when constructing the data and using this when
      determining the length of the request.
      Signed-off-by: default avatarChris Dickens <christopher.a.dickens@gmail.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      5d6ae4f0