Commit 90c4d057 authored by Maciej Żenczykowski's avatar Maciej Żenczykowski Committed by Greg Kroah-Hartman
Browse files

usb: fix various gadgets null ptr deref on 10gbps cabling. 



This avoids a null pointer dereference in
f_{ecm,eem,hid,loopback,printer,rndis,serial,sourcesink,subset,tcm}
by simply reusing the 5gbps config for 10gbps.

Fixes: eaef50c7 ("usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus")
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Michael R Sweet <msweet@msweet.org>
Cc: Mike Christie <michael.christie@oracle.com>
Cc: Pawel Laszczak <pawell@cadence.com>
Cc: Peter Chen <peter.chen@nxp.com>
Cc: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
Cc: Wei Ming Chen <jj251510319013@gmail.com>
Cc: Will McVicker <willmcvicker@google.com>
Cc: Zqiang <qiang.zhang@windriver.com>
Reviewed-By: default avatarLorenzo Colitti <lorenzo@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarMaciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20210608044141.3898496-1-zenczykowski@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d1658268

drivers/usb/gadget/function/f_ecm.c

+1 −1
Original line number Diff line number Diff line
@@ -791,7 +791,7 @@ ecm_bind(struct usb_configuration *c, struct usb_function *f) 
		fs_ecm_notify_desc.bEndpointAddress;



	status = usb_assign_descriptors(f, ecm_fs_function, ecm_hs_function,

			ecm_ss_function, NULL);

			ecm_ss_function, ecm_ss_function);

	if (status)

		goto fail;

drivers/usb/gadget/function/f_eem.c

+1 −1
Original line number Diff line number Diff line
@@ -302,7 +302,7 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f) 
	eem_ss_out_desc.bEndpointAddress = eem_fs_out_desc.bEndpointAddress;



	status = usb_assign_descriptors(f, eem_fs_function, eem_hs_function,

			eem_ss_function, NULL);

			eem_ss_function, eem_ss_function);

	if (status)

		goto fail;

drivers/usb/gadget/function/f_hid.c

+2 −1
Original line number Diff line number Diff line
@@ -802,7 +802,8 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) 
		hidg_fs_out_ep_desc.bEndpointAddress;



	status = usb_assign_descriptors(f, hidg_fs_descriptors,

			hidg_hs_descriptors, hidg_ss_descriptors, NULL);

			hidg_hs_descriptors, hidg_ss_descriptors,

			hidg_ss_descriptors);

	if (status)

		goto fail;

drivers/usb/gadget/function/f_loopback.c

+1 −1
Original line number Diff line number Diff line
@@ -207,7 +207,7 @@ static int loopback_bind(struct usb_configuration *c, struct usb_function *f) 
	ss_loop_sink_desc.bEndpointAddress = fs_loop_sink_desc.bEndpointAddress;



	ret = usb_assign_descriptors(f, fs_loopback_descs, hs_loopback_descs,

			ss_loopback_descs, NULL);

			ss_loopback_descs, ss_loopback_descs);

	if (ret)

		return ret;

drivers/usb/gadget/function/f_printer.c

+2 −1
Original line number Diff line number Diff line
@@ -1101,7 +1101,8 @@ static int printer_func_bind(struct usb_configuration *c, 
	ss_ep_out_desc.bEndpointAddress = fs_ep_out_desc.bEndpointAddress;



	ret = usb_assign_descriptors(f, fs_printer_function,

			hs_printer_function, ss_printer_function, NULL);

			hs_printer_function, ss_printer_function,

			ss_printer_function);

	if (ret)

		return ret;