USB: add usb_control_msg_send() and usb_control_msg_recv()
mainline inclusion from mainline-v5.10-rc1 commit 719b8f28 category: bugfix bugzilla: 188090, https://gitee.com/src-openeuler/kernel/issues/I6068W CVE: CVE-2022-3903 -------------------------------- New core functions to make sending/receiving USB control messages easier and saner. In discussions, it turns out that the large majority of users of usb_control_msg() do so in potentially incorrect ways. The most common issue is where a "short" message is received, yet never detected properly due to "incorrect" error handling. Handle all of this in the USB core with two new functions to try to make working with USB control messages simpler. No more need for dynamic data, messages can be on the stack, and only "complete" send/receive will work without causing an error. Link: https://lore.kernel.org/r/20200914153756.3412156-3-gregkh@linuxfoundation.org Signed-off-by:Greg Kroah-Hartman <gregkh@linuxfoundation.org> The parts related to usb_control_msg_send() and usb_control_msg_recv() in commit USB: correct API of usb_control_msg_send/recv are added to solve CVE. Commit USB: core: drop pipe-type check from new control-message helpers is also added. Signed-off-by:
Zhang Peng <zhangpeng362@huawei.com> Reviewed-by:
Xiu Jianfeng <xiujianfeng@huawei.com> Reviewed-by:
Kefeng Wang <wangkefeng.wang@huawei.com> Signed-off-by:
Yongqiang Liu <liuyongqiang13@huawei.com>
Loading
Please sign in to comment