Commit 24a8f66f authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Zheng Zengkai
Browse files

USB: gadget: bRequestType is a bitfield, not a enum

mainline inclusion
form mainline-v5.16-rc6
commit f08adf5a
bugzilla: 185937 https://gitee.com/openeuler/kernel/issues/I4DDEL
CVE: CVE-2021-39685

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f08adf5add9a071160c68bb2a61d697f39ab0758



--------------------------------

Szymon rightly pointed out that the previous check for the endpoint
direction in bRequestType was not looking at only the bit involved, but
rather the whole value.  Normally this is ok, but for some request
types, bits other than bit 8 could be set and the check for the endpoint
length could not stall correctly.

Fix that up by only checking the single bit.

Fixes: 153a2d7e ("USB: gadget: detect too-big endpoint 0 requests")
Cc: Felipe Balbi <balbi@kernel.org>
Reported-by: default avatarSzymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20211214184621.385828-1-gregkh@linuxfoundation.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 93df9d57
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment