[1/2] usb: gadget: f_midi: fail if set_alt fails to allocate requests
diff mbox series

Message ID 20190814232145.5623-2-tyhicks@canonical.com
State New
Headers show
Series
  • CVE-2018-20961: USB Gadget MIDI Function UAF
Related show

Commit Message

Tyler Hicks Aug. 14, 2019, 11:21 p.m. UTC
From: "Felipe F. Tonello" <eu@felipetonello.com>

This ensures that the midi function will only work if the proper number of
IN and OUT requrests are allocated. Otherwise the function will work with less
requests then what the user wants.

Signed-off-by: Felipe F. Tonello <eu@felipetonello.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

CVE-2018-20961

(cherry picked from commit f0f1b8cac4d8d973e95f25d9ea132775fb43c5f4)
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 drivers/usb/gadget/function/f_midi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Patch
diff mbox series

diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 5ead414586a1..89db9cd22665 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -364,9 +364,10 @@  static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 		req->complete = f_midi_complete;
 		err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC);
 		if (err) {
-			ERROR(midi, "%s queue req: %d\n",
+			ERROR(midi, "%s: couldn't enqueue request: %d\n",
 				    midi->out_ep->name, err);
 			free_ep_req(midi->out_ep, req);
+			return err;
 		}
 	}