linux-kernel - [PATCH v2] usb: cdnsp: Fix wrong transmission direction of EP0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221101044433.5627-1-3090101217@zju.edu.cn>
Date:   Tue,  1 Nov 2022 12:44:33 +0800
From:   Jing Leng <3090101217@....edu.cn>
To:     3090101217@....edu.cn
Cc:     gregkh@...uxfoundation.org, jleng@...arella.com,
        linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
        pawell@...ence.com
Subject: [PATCH v2] usb: cdnsp: Fix wrong transmission direction of EP0

EP0 transfer is bi-directional, but in the cdnsp gadget, the
transmission direction of EP0 is not changed after it is
initialized to IN, so the OUT data from EP0 received by the host
is invalid.

The value of ep0_expect_in will change according to the value of
bRequestType in the SETUP transaction of control transfer, so we
can use it as the transmission direction of EP0.

Signed-off-by: Jing Leng <3090101217@....edu.cn>
Signed-off-by: Jing Leng <jleng@...arella.com>
---
ChangeLog v1->v2:
- Rebase the patch.
- Make email addresses ('From' and 'Signed-off-by') consistent.
---
 drivers/usb/cdns3/cdnsp-gadget.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
index c67715f6f756..526f80651d35 100644
--- a/drivers/usb/cdns3/cdnsp-gadget.c
+++ b/drivers/usb/cdns3/cdnsp-gadget.c
@@ -345,6 +345,7 @@ int cdnsp_ep_enqueue(struct cdnsp_ep *pep, struct cdnsp_request *preq)
 {
 	struct cdnsp_device *pdev = pep->pdev;
 	struct usb_request *request;
+	u8 direction;
 	int ret;
 
 	if (preq->epnum == 0 && !list_empty(&pep->pending_list)) {
@@ -355,11 +356,14 @@ int cdnsp_ep_enqueue(struct cdnsp_ep *pep, struct cdnsp_request *preq)
 	request = &preq->request;
 	request->actual = 0;
 	request->status = -EINPROGRESS;
-	preq->direction = pep->direction;
+
+	direction = usb_endpoint_xfer_control(pep->endpoint.desc) ?
+		    pdev->ep0_expect_in : pep->direction;
+	preq->direction = direction;
 	preq->epnum = pep->number;
 	preq->td.drbl = 0;
 
-	ret = usb_gadget_map_request_by_dev(pdev->dev, request, pep->direction);
+	ret = usb_gadget_map_request_by_dev(pdev->dev, request, direction);
 	if (ret) {
 		trace_cdnsp_request_enqueue_error(preq);
 		return ret;
@@ -387,8 +391,7 @@ int cdnsp_ep_enqueue(struct cdnsp_ep *pep, struct cdnsp_request *preq)
 	return 0;
 
 unmap:
-	usb_gadget_unmap_request_by_dev(pdev->dev, &preq->request,
-					pep->direction);
+	usb_gadget_unmap_request_by_dev(pdev->dev, &preq->request, direction);
 	list_del(&preq->list);
 	trace_cdnsp_request_enqueue_error(preq);
 
-- 
2.17.1