summaryrefslogtreecommitdiff
path: root/drivers/usb/gadget/composite.c
diff options
context:
space:
mode:
authorRoger Quadros <roger.quadros@nokia.com>2010-09-08 13:48:44 +0300
committerGreg Kroah-Hartman <gregkh@suse.de>2010-10-22 10:21:37 -0700
commit5c836e4d583701a5eecb288b5f131da39115f5ec (patch)
tree322bb97d9988b86bb29748a210798fc166f14f35 /drivers/usb/gadget/composite.c
parent3df7169e73fc1d71a39cffeacc969f6840cdf52b (diff)
downloadlinux-5c836e4d583701a5eecb288b5f131da39115f5ec.tar.gz
usb gadget: composite: prevent OOPS for non-standard control request
The composite gadget will OOPS if the host sends a control request targetted to an interface of an un-configured composite device. This patch prevents this. The OOPS was observed during WHQL USB CV tests. With this patch, the device STALLs as per requirement. Failing test case: From host do the following. I used libusb-1.0 1) Set configuration to zero. libusb_control_transfer(device_handle, 0, /* standard OUT */ 0x9, /* setConfiguration */ 0, 0, NULL, 0, 0); 2) Query current configuratioan. libusb_control_transfer(device_handle, 0x80, /* standard IN*/ 0x8, /* getConfiguration */ 0, 0, data, 1, 0); 3) Send the non-standard ctrl transfer targetted to interface libusb_control_transfer(device_handle, 0x81, /* standard IN to interface*/ 0x6, /* getDescriptor */ 0x2300, 0, data, 0x12, 0); Signed-off-by: Roger Quadros <roger.quadros@nokia.com> Cc: stable <stable@kernel.org> Cc: David Brownell <dbrownell@users.sourceforge.net> Cc: Michal Nazarewicz <m.nazarewicz@samsung.com> Cc: Robert Lukassen <robert.lukassen@tomtom.com> Cc: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/gadget/composite.c')
-rw-r--r--drivers/usb/gadget/composite.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 5e2bd7428424..7b5cc16e4a0b 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -928,7 +928,8 @@ unknown:
*/
switch (ctrl->bRequestType & USB_RECIP_MASK) {
case USB_RECIP_INTERFACE:
- f = cdev->config->interface[intf];
+ if (cdev->config)
+ f = cdev->config->interface[intf];
break;
case USB_RECIP_ENDPOINT: