diff mbox series

[v2,3/7] f_sdp: Fix wrong usb request size

Message ID 20200818101649.16509-4-peng.fan@nxp.com
State Accepted
Commit 5dee7f0b0233f8b4e43e1212a6a96cdee835a8e6
Delegated to: Lukasz Majewski
Headers show
Series f_sdp: fix and update | expand

Commit Message

Peng Fan Aug. 18, 2020, 10:16 a.m. UTC
From: Ye Li <ye.li@nxp.com>

Because the buffer length of sdp usb request is 65, we have to allocate
65 bytes not 64 bytes. Otherwise there is potential buffer overflow.

Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 drivers/usb/gadget/f_sdp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Lukasz Majewski Aug. 18, 2020, 11:24 a.m. UTC | #1
On Tue, 18 Aug 2020 18:16:45 +0800
Peng Fan <peng.fan@nxp.com> wrote:

> From: Ye Li <ye.li@nxp.com>
> 
> Because the buffer length of sdp usb request is 65, we have to
> allocate 65 bytes not 64 bytes. Otherwise there is potential buffer
> overflow.
> 
> Signed-off-by: Ye Li <ye.li@nxp.com>
> Signed-off-by: Peng Fan <peng.fan@nxp.com>
> ---
>  drivers/usb/gadget/f_sdp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/gadget/f_sdp.c b/drivers/usb/gadget/f_sdp.c
> index f971ccdeca..eec7560fc2 100644
> --- a/drivers/usb/gadget/f_sdp.c
> +++ b/drivers/usb/gadget/f_sdp.c
> @@ -548,7 +548,7 @@ static struct usb_request *sdp_start_ep(struct
> usb_ep *ep) {
>  	struct usb_request *req;
>  
> -	req = alloc_ep_req(ep, 64);
> +	req = alloc_ep_req(ep, 65);
>  	debug("%s: ep:%p req:%p\n", __func__, ep, req);
>  
>  	if (!req)

Reviewed-by: Lukasz Majewski <lukma@denx.de>


Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma@denx.de
diff mbox series

Patch

diff --git a/drivers/usb/gadget/f_sdp.c b/drivers/usb/gadget/f_sdp.c
index f971ccdeca..eec7560fc2 100644
--- a/drivers/usb/gadget/f_sdp.c
+++ b/drivers/usb/gadget/f_sdp.c
@@ -548,7 +548,7 @@  static struct usb_request *sdp_start_ep(struct usb_ep *ep)
 {
 	struct usb_request *req;
 
-	req = alloc_ep_req(ep, 64);
+	req = alloc_ep_req(ep, 65);
 	debug("%s: ep:%p req:%p\n", __func__, ep, req);
 
 	if (!req)