diff options
| author | Mayank Rana <mrana@codeaurora.org> | 2017-11-10 14:20:32 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-01-02 02:46:14 -0800 |
| commit | 189b4c8d28302e6f91535ed85cea4f968578636b (patch) | |
| tree | 241e51770e026647bbf44accffacd6c4d170f7d5 /drivers/usb | |
| parent | eb1480ce5a93bdf1e8b42c4ce0e5365253e78bd4 (diff) | |
usb: f_gsi: Use required RNDIS IAD descriptors with full speed descriptors
gsi_eth_fs_function is array of pointers to set of RNDIS interface
related descriptors. gsi_eth_fs_function's first descriptor is
pointing itself instead of required RNDIS IAD descriptor. This
results into out-of-bound read access while copying these set of
descriptors with usb_copy_descriptors() API. Fix this issue by
using required RNDIS IAD descriptor here.
Change-Id: Ic604221febc43eb8a22d8de99fb8cead74e13b41
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/function/f_gsi.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/f_gsi.h b/drivers/usb/gadget/function/f_gsi.h index 14490ab296c2..829e1fcbe156 100644 --- a/drivers/usb/gadget/function/f_gsi.h +++ b/drivers/usb/gadget/function/f_gsi.h @@ -565,7 +565,7 @@ static struct usb_endpoint_descriptor rndis_gsi_fs_out_desc = { }; static struct usb_descriptor_header *gsi_eth_fs_function[] = { - (struct usb_descriptor_header *) &gsi_eth_fs_function, + (struct usb_descriptor_header *) &rndis_gsi_iad_descriptor, /* control interface matches ACM, not Ethernet */ (struct usb_descriptor_header *) &rndis_gsi_control_intf, (struct usb_descriptor_header *) &rndis_gsi_header_desc, |