diff options
| author | Hemant Kumar <hemantk@codeaurora.org> | 2016-05-04 19:30:23 -0700 |
|---|---|---|
| committer | Jeevan Shriram <jshriram@codeaurora.org> | 2016-05-11 17:43:58 -0700 |
| commit | b3a6d13c131943e2a5bd629cd669f63eda921a75 (patch) | |
| tree | 232343f0a2924bb8fc2ae3b1819aa635e4de736d | |
| parent | 6f856046e001fbb16a9e3f74a5fda8f924c445d5 (diff) | |
usb: gadget: composite: Handle OS descriptor request properly
In case w_index or w_value of an OS descriptor does not match
for a device or an interface, value remains set to -EOPNOTSUPP.
This is assigned to an unsigned request length and becomes a
large integer value. When driver tries to allocate a buffer
of this large integer value DMA allocator complaints for out of
SW-IOMMU space. Hence check this variable for negative value and
return without queuing ep0 request.
CRs-Fixed: 1013316
Change-Id: I705d0d54fb17ca3042533f0106f91912215bd52a
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
| -rw-r--r-- | drivers/usb/gadget/composite.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 67aa070effe4..e2049464af11 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1912,6 +1912,16 @@ unknown: } break; } + + if (value < 0) { + DBG(cdev, "%s: unhandled os desc request\n", + __func__); + DBG(cdev, "req%02x.%02x v%04x i%04x l%d\n", + ctrl->bRequestType, ctrl->bRequest, + w_value, w_index, w_length); + return value; + } + req->length = value; req->context = cdev; req->zero = value < w_length; |