releases/2.6.38.8/usb-gadget-rndis-don-t-test-against-req-length.patch

   1 From 472b91274a6c6857877b5caddb875dcb5ecdfcb8 Mon Sep 17 00:00:00 2001
   2 From: Felipe Balbi <balbi@ti.com>
   3 Date: Fri, 13 May 2011 16:53:48 +0300
   4 Subject: usb: gadget: rndis: don't test against req->length
   5
   6 From: Felipe Balbi <balbi@ti.com>
   7
   8 commit 472b91274a6c6857877b5caddb875dcb5ecdfcb8 upstream.
   9
  10 composite.c always sets req->length to zero
  11 and expects function driver's setup handlers
  12 to return the amount of bytes to be used
  13 on req->length. If we test against req->length
  14 w_length will always be greater than req->length
  15 thus making us always stall that particular
  16 SEND_ENCAPSULATED_COMMAND request.
  17
  18 Tested against a Windows XP SP3.
  19
  20 Signed-off-by: Felipe Balbi <balbi@ti.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  22
  23 ---
  24  drivers/usb/gadget/f_rndis.c |    3 +--
  25  1 file changed, 1 insertion(+), 2 deletions(-)
  26
  27 --- a/drivers/usb/gadget/f_rndis.c
  28 +++ b/drivers/usb/gadget/f_rndis.c
  29 @@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, cons
  30          */
  31         case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
  32                         | USB_CDC_SEND_ENCAPSULATED_COMMAND:
  33 -               if (w_length > req->length || w_value
  34 -                               || w_index != rndis->ctrl_id)
  35 +               if (w_value || w_index != rndis->ctrl_id)
  36                         goto invalid;
  37                 /* read the request; process it later */
  38                 value = w_length;