USB: gadget: detect too-big endpoint 0 requests
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Dec 2021 17:59:27 +0000 (18:59 +0100)
committerPDO SCM Team <hudsoncm@motorola.com>
Tue, 8 Mar 2022 06:25:48 +0000 (00:25 -0600)
commit27bd94f81365b68f148e19caea843a60d13b20f3
tree2807ac93dbf8f2f901a5b93a8738c41555b4b8dd
parent42262a0a0a1af9ab6e5698c4f4830decfe96e3c9
USB: gadget: detect too-big endpoint 0 requests

commit 153a2d7e3350cc89d406ba2d35be8793a64c2038 upstream.

Sometimes USB hosts can ask for buffers that are too large from endpoint
0, which should not be allowed.  If this happens for OUT requests, stall
the endpoint, but for IN requests, trim the request size to the endpoint
buffer size.

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2021-39685
Bug: 210292376

Change-Id: I31c5a748a697b7ff28456b1caee117c2da3378f2
Co-developed-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Gajjala Chakradhar <gajjalac@motorola.com>
Reviewed-on: https://gerrit.mot.com/2197705
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
(cherry picked from commit 273f9ad1e901701ea311946408128e9651ed42f3)
drivers/usb/gadget/composite.c
drivers/usb/gadget/legacy/dbgp.c
drivers/usb/gadget/legacy/inode.c