Chris Wulff 0aea736ddb usb: gadget: f_fs: Fix a race condition when processing setup packets. ...

If the USB driver passes a pointer into the TRB buffer for creq, this
buffer can be overwritten with the status response as soon as the event
is queued. This can make the final check return USB_GADGET_DELAYED_STATUS
when it shouldn't. Instead use the stored wLength.

Fixes: 4d644abf25 ("usb: gadget: f_fs: Only return delayed status when len is 0")
Cc: stable <stable@kernel.org>
Signed-off-by: Chris Wulff <chris.wulff@biamp.com>
Link: https://lore.kernel.org/r/CO1PR17MB5419BD664264A558B2395E28E1112@CO1PR17MB5419.namprd17.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-04-23 16:26:10 -07:00

..

f_acm.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_ecm.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_eem.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_fs.c

usb: gadget: f_fs: Fix a race condition when processing setup packets.

2024-04-23 16:26:10 -07:00

f_hid.c

usb: gadget: f_hid: fix report descriptor allocation

2023-12-07 10:12:05 +09:00

f_loopback.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_mass_storage.c

usb: f_mass_storage: forbid async queue when shutdown happen

2024-01-27 16:40:07 -08:00

f_mass_storage.h

…

f_midi2.c

usb: gadget: unconditionally allocate hs/ss descriptor in bind operation

2023-08-22 14:48:33 +02:00

f_midi.c

usb: gadget: f_midi: Replace strlcpy() with strscpy()

2023-11-22 12:02:53 +00:00

f_ncm.c

usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error

2024-04-04 16:55:53 +02:00

f_obex.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_phonet.c

…

f_printer.c

…

f_rndis.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_serial.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_sourcesink.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_subset.c

usb: gadget: remove max support speed info in bind operation

2023-08-22 14:48:33 +02:00

f_tcm.c

usb: gadget: f_tcm: Remove snprintf() from sysfs call-backs and replace with sysfs_emit()

2023-12-04 22:25:17 +09:00

f_uac1_legacy.c

…

f_uac1.c

usb: gadget: f_uac1: Replace snprintf() with the safer scnprintf() variant

2023-12-15 13:55:29 +01:00

f_uac2.c

usb: gadget: f_uac2: Replace snprintf() with the safer scnprintf() variant

2023-12-15 13:55:29 +01:00

f_uvc.c

Revert "usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind()"

2024-01-04 16:01:45 +01:00

f_uvc.h

usb: gadget: uvc: prevent use of disabled endpoint

2023-11-23 12:32:44 +00:00

g_zero.h

…

Makefile

…

ndis.h

…

rndis.c

…

rndis.h

…

storage_common.c

…

storage_common.h

…

tcm.h

…

u_audio.c

…

u_audio.h

…

u_ecm.h

…

u_eem.h

…

u_ether_configfs.h

…

u_ether.c

usb: gadget: constify the struct device_type usage

2024-02-19 09:35:46 +01:00

u_ether.h

usb: gadget: add a inline function gether_bitrate()

2023-08-22 14:48:33 +02:00

u_fs.h

…

u_gether.h

…

u_hid.h

…

u_midi2.h

…

u_midi.h

…

u_ncm.h

usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs

2024-01-04 16:01:14 +01:00

u_phonet.h

…

u_printer.h

…

u_rndis.h

…

u_serial.c

…

u_serial.h

…

u_tcm.h

…

u_uac1_legacy.c

…

u_uac1_legacy.h

…

u_uac1.h

…

u_uac2.h

usb: gadget: f_uac2: allow changing terminal types through configfs

2023-10-05 09:35:43 +02:00

u_uvc.h

usb: gadget: webcam: Make g_webcam loadable again

2023-12-15 18:27:38 +01:00

uac_common.h

…

uvc_configfs.c

usb: gadget: uvc: use correct buffer size when parsing configfs lists

2024-04-23 16:25:13 -07:00

uvc_configfs.h

…

uvc_queue.c

…

uvc_queue.h

…

uvc_v4l2.c

usb: gadget: uvc: Fix use-after-free for inflight usb_requests

2023-11-23 12:32:44 +00:00

uvc_v4l2.h

…

uvc_video.c

usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR

2024-02-17 17:08:45 +01:00

uvc_video.h

usb: gadget: uvc: move video disable logic to its own function

2023-11-23 12:32:44 +00:00

uvc.h

usb:gadget:uvc Do not use worker thread to pump isoc usb requests

2023-11-23 12:32:44 +00:00