From: Ana Bobillo <[email protected]>
composite_setup() hands every control request's wLength on, unchecked,
as the data stage length, while the ep0 request it queues, cdev->req,
has a buffer of USB_BUFSIZ (4096) bytes. Two handlers take that length
as it comes: the OS descriptor vendor request clears and returns
wLength bytes of that buffer, and the SDP function's report 2
SET_REPORT queues wLength bytes into it. A host sending a longer
wLength has the data stage run past the end of the buffer.
Linux closed this for all of its composite functions in one place,
commit 36dfdf11af49 ("USB: gadget: detect too-big endpoint 0
requests"), and barebox carries the same check: stall an OUT request
longer than the buffer, and shorten an IN request to it. Do the same
here, so no function behind the composite layer can be handed a data
stage the buffer does not hold.
No request a gadget function handles needs more: the largest legitimate
data stages are DFU's DNLOAD/UPLOAD at DFU_USB_BUFSIZ (4096) and the
SDP report 2 of 1025 bytes.
Fixes: a764c941289c ("usb: gadget: OS Feature Descriptors support")
Fixes: 5661f08a7144 ("usb: gadget: add SDP driver")
Signed-off-by: Ana Bobillo <[email protected]>
---
drivers/usb/gadget/composite.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 04b85419931..d6147d22936 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1019,6 +1019,22 @@ composite_setup(struct usb_gadget *gadget, const struct
usb_ctrlrequest *ctrl)
u8 endp;
struct usb_configuration *c;
+ /*
+ * The data stage of every request handled here, or by a function
+ * through cdev->req, goes through the USB_BUFSIZ ep0 buffer.
+ */
+ if (w_length > USB_BUFSIZ) {
+ if (ctrl->bRequestType & USB_DIR_IN) {
+ /* Cast away the const, we are going to overwrite on
purpose. */
+ __le16 *temp = (__le16 *)&ctrl->wLength;
+
+ *temp = cpu_to_le16(USB_BUFSIZ);
+ w_length = USB_BUFSIZ;
+ } else {
+ goto done;
+ }
+ }
+
/*
* partial re-init of the response message; the function or the
* gadget might need to intercept e.g. a control-OUT completion
