USB: gadget: bRequestType is a bitfield, not a enum

Szymon rightly pointed out that the previous check for the endpoint
direction in bRequestType was not looking at only the bit involved, but
rather the whole value.  Normally this is ok, but for some request
types, bits other than bit 8 could be set and the check for the endpoint
length could not stall correctly.

Fix that up by only checking the single bit.

Fixes: 153a2d7e3350 ("USB: gadget: detect too-big endpoint 0 requests")
Cc: Felipe Balbi <balbi@kernel.org>
Reported-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Link: https://lore.kernel.org/r/20211214184621.385828-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 284eea9f6e4d8dbfc603e7ad77a8674904bb3a3f..3789c329183ca6e5789ea1c529a6bc8a80759888 100644 (file)
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1680,14 +1680,14 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
        u8                              endp;
 
        if (w_length > USB_COMP_EP0_BUFSIZ) {
-               if (ctrl->bRequestType == USB_DIR_OUT) {
-                       goto done;
-               } else {
+               if (ctrl->bRequestType & USB_DIR_IN) {
                        /* Cast away the const, we are going to overwrite on purpose. */
                        __le16 *temp = (__le16 *)&ctrl->wLength;
 
                        *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ);
                        w_length = USB_COMP_EP0_BUFSIZ;
+               } else {
+                       goto done;
                }
        }
 

diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index 355bc7dab9d5f623fbef3b92dd2530d2dc47e443..6bcbad382580203e0aafbe012c202c3587297a3a 100644 (file)
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -346,14 +346,14 @@ static int dbgp_setup(struct usb_gadget *gadget,
        u16 len = 0;
 
        if (length > DBGP_REQ_LEN) {
-               if (ctrl->bRequestType == USB_DIR_OUT) {
-                       return err;
-               } else {
+               if (ctrl->bRequestType & USB_DIR_IN) {
                        /* Cast away the const, we are going to overwrite on purpose. */
                        __le16 *temp = (__le16 *)&ctrl->wLength;
 
                        *temp = cpu_to_le16(DBGP_REQ_LEN);
                        length = DBGP_REQ_LEN;
+               } else {
+                       return err;
                }
        }
 

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index 63150e3889efb12787f4440416ef761df71bb7fa..3b58f4fc0a806ef8759c35ebdb3a4c3a6ea3ab08 100644 (file)
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1334,14 +1334,14 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
        u16                             w_length = le16_to_cpu(ctrl->wLength);
 
        if (w_length > RBUF_SIZE) {
-               if (ctrl->bRequestType == USB_DIR_OUT) {
-                       return value;
-               } else {
+               if (ctrl->bRequestType & USB_DIR_IN) {
                        /* Cast away the const, we are going to overwrite on purpose. */
                        __le16 *temp = (__le16 *)&ctrl->wLength;
 
                        *temp = cpu_to_le16(RBUF_SIZE);
                        w_length = RBUF_SIZE;
+               } else {
+                       return value;
                }
        }