| From 1a3910c80966e4a76b25ce812f6bea0ef1b1d530 Mon Sep 17 00:00:00 2001 |
| From: Pavel Hofman <pavel.hofman@ivitera.com> |
| Date: Fri, 10 Dec 2021 09:52:18 +0100 |
| Subject: usb: core: config: fix validation of wMaxPacketValue entries |
| |
| From: Pavel Hofman <pavel.hofman@ivitera.com> |
| |
| commit 1a3910c80966e4a76b25ce812f6bea0ef1b1d530 upstream. |
| |
| The checks performed by commit aed9d65ac327 ("USB: validate |
| wMaxPacketValue entries in endpoint descriptors") require that initial |
| value of the maxp variable contains both maximum packet size bits |
| (10..0) and multiple-transactions bits (12..11). However, the existing |
| code assings only the maximum packet size bits. This patch assigns all |
| bits of wMaxPacketSize to the variable. |
| |
| Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors") |
| Cc: stable <stable@vger.kernel.org> |
| Acked-by: Alan Stern <stern@rowland.harvard.edu> |
| Signed-off-by: Pavel Hofman <pavel.hofman@ivitera.com> |
| Link: https://lore.kernel.org/r/20211210085219.16796-1-pavel.hofman@ivitera.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/usb/core/config.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/usb/core/config.c |
| +++ b/drivers/usb/core/config.c |
| @@ -375,7 +375,7 @@ static int usb_parse_endpoint(struct dev |
| * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 |
| * (see the end of section 5.6.3), so don't warn about them. |
| */ |
| - maxp = usb_endpoint_maxp(&endpoint->desc); |
| + maxp = le16_to_cpu(endpoint->desc.wMaxPacketSize); |
| if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { |
| dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", |
| cfgno, inum, asnum, d->bEndpointAddress); |