1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
From ed62e36cc3d52d3bcfb5ec2ce20f9317cefaef67 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 21 Oct 2022 08:33:30 +0200
Subject: [PATCH] USB: gadget: dummy_hcd: switch char * to u8 *
The function handle_control_request() casts the urb buffer to a char *,
and then treats it like a unsigned char buffer when assigning data to
it. On some architectures, "char" is really signed, so let's just
properly set this pointer to a u8 to take away any potential problems as
that's what is really wanted here.
Document that we are only using the lower 8 bits for the devstatus
variable (only 7 are currently used), as the cast from 16 to 8 is not
obvious.
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Jakob Koschel <jakobkoschel@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: Ira Weiny <ira.weiny@intel.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/dummy_hcd.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1747,13 +1747,13 @@ static int handle_control_request(struct
if (setup->bRequestType == Dev_InRequest
|| setup->bRequestType == Intf_InRequest
|| setup->bRequestType == Ep_InRequest) {
- char *buf;
+ u8 *buf;
/*
- * device: remote wakeup, selfpowered
+ * device: remote wakeup, selfpowered, LTM, U1, or U2
* interface: nothing
* endpoint: halt
*/
- buf = (char *)urb->transfer_buffer;
+ buf = urb->transfer_buffer;
if (urb->transfer_buffer_length > 0) {
if (setup->bRequestType == Ep_InRequest) {
ep2 = find_endpoint(dum, w_index);
@@ -1762,11 +1762,12 @@ static int handle_control_request(struct
break;
}
buf[0] = ep2->halted;
- } else if (setup->bRequestType ==
- Dev_InRequest) {
+ } else if (setup->bRequestType == Dev_InRequest) {
+ /* Only take the lower 8 bits */
buf[0] = (u8)dum->devstatus;
- } else
+ } else {
buf[0] = 0;
+ }
}
if (urb->transfer_buffer_length > 1)
buf[1] = 0;
|
