From 0878263b68df372e6389b050fc2bd4f6d5b9f332 Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Fri, 22 Apr 2016 14:53:47 +0300 Subject: [PATCH] usb: gadget: composite: avoid kernel oops with bad gadgets If a gadget driver loaded to a Superspeed-capable peripheral controller, using a Superspeed cable, doesn't provide Superspeed descriptors, we will get a NULL pointer dereference. In order to avoid that situation, we will try to find any valid descriptors we can. If no set of descriptors is passed in, then we'll let that gadget oops anyhow. Signed-off-by: Felipe Balbi --- drivers/usb/gadget/composite.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index de9ffd60fcfa..3d3cdc5ed20d 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -66,20 +66,36 @@ function_descriptors(struct usb_function *f, { struct usb_descriptor_header **descriptors; + /* + * NOTE: we try to help gadget drivers which might not be setting + * max_speed appropriately. + */ + switch (speed) { case USB_SPEED_SUPER_PLUS: descriptors = f->ssp_descriptors; - break; + if (descriptors) + break; + /* FALLTHROUGH */ case USB_SPEED_SUPER: descriptors = f->ss_descriptors; - break; + if (descriptors) + break; + /* FALLTHROUGH */ case USB_SPEED_HIGH: descriptors = f->hs_descriptors; - break; + if (descriptors) + break; + /* FALLTHROUGH */ default: descriptors = f->fs_descriptors; } + /* + * if we can't find any descriptors at all, then this gadget deserves to + * Oops with a NULL pointer dereference + */ + return descriptors; } -- 2.20.1