diff options
Diffstat (limited to '0001-USB-gadget-dummy_hcd-switch-char-to-u8.patch')
| -rw-r--r-- | 0001-USB-gadget-dummy_hcd-switch-char-to-u8.patch | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/0001-USB-gadget-dummy_hcd-switch-char-to-u8.patch b/0001-USB-gadget-dummy_hcd-switch-char-to-u8.patch new file mode 100644 index 00000000000000..ee75c4e107d866 --- /dev/null +++ b/0001-USB-gadget-dummy_hcd-switch-char-to-u8.patch @@ -0,0 +1,61 @@ +From ed62e36cc3d52d3bcfb5ec2ce20f9317cefaef67 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Date: Fri, 21 Oct 2022 08:33:30 +0200 +Subject: [PATCH] USB: gadget: dummy_hcd: switch char * to u8 * + +The function handle_control_request() casts the urb buffer to a char *, +and then treats it like a unsigned char buffer when assigning data to +it. On some architectures, "char" is really signed, so let's just +properly set this pointer to a u8 to take away any potential problems as +that's what is really wanted here. + +Document that we are only using the lower 8 bits for the devstatus +variable (only 7 are currently used), as the cast from 16 to 8 is not +obvious. + +Cc: Felipe Balbi <balbi@kernel.org> +Cc: Jakob Koschel <jakobkoschel@gmail.com> +Cc: Randy Dunlap <rdunlap@infradead.org> +Cc: Ira Weiny <ira.weiny@intel.com> +Cc: Alan Stern <stern@rowland.harvard.edu> +Reported-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/gadget/udc/dummy_hcd.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -1741,13 +1741,13 @@ static int handle_control_request(struct + if (setup->bRequestType == Dev_InRequest + || setup->bRequestType == Intf_InRequest + || setup->bRequestType == Ep_InRequest) { +- char *buf; ++ u8 *buf; + /* +- * device: remote wakeup, selfpowered ++ * device: remote wakeup, selfpowered, LTM, U1, or U2 + * interface: nothing + * endpoint: halt + */ +- buf = (char *)urb->transfer_buffer; ++ buf = urb->transfer_buffer; + if (urb->transfer_buffer_length > 0) { + if (setup->bRequestType == Ep_InRequest) { + ep2 = find_endpoint(dum, w_index); +@@ -1756,11 +1756,12 @@ static int handle_control_request(struct + break; + } + buf[0] = ep2->halted; +- } else if (setup->bRequestType == +- Dev_InRequest) { ++ } else if (setup->bRequestType == Dev_InRequest) { ++ /* Only take the lower 8 bits */ + buf[0] = (u8)dum->devstatus; +- } else ++ } else { + buf[0] = 0; ++ } + } + if (urb->transfer_buffer_length > 1) + buf[1] = 0; |