From f588c0db39ca35f69f815dabe5682759daa25098 Mon Sep 17 00:00:00 2001 From: Michal Nazarewicz Date: Mon, 14 Jun 2010 10:43:34 +0200 Subject: [PATCH] USB: gadget: g_fs: possible invalid pointer reference bug fixed During __gfs_do_config() some invalid pointers may be left in usb_configuration::interfaces array from previous calls to the __gfs_do_config() for the same configuration. This will always happen if an user space function which has a fewer then the last user space function registers itself. Composite's set_config() function that a pointer after the last interface in usb_configuration::interface is NULL unless the array is full. This patch makes the __gfs_do_config() make sure that if the usb_configuration::interface is not full then a pointer after the last interface is NULL. Signed-off-by: Michal Nazarewicz Signed-off-by: Kyungmin Park Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/g_ffs.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c index 4b0e4a0..d1af253 100644 --- a/drivers/usb/gadget/g_ffs.c +++ b/drivers/usb/gadget/g_ffs.c @@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c, if (unlikely(ret < 0)) return ret; + /* After previous do_configs there may be some invalid + * pointers in c->interface array. This happens every time + * a user space function with fewer interfaces than a user + * space function that was run before the new one is run. The + * compasit's set_config() assumes that if there is no more + * then MAX_CONFIG_INTERFACES interfaces in a configuration + * then there is a NULL pointer after the last interface in + * c->interface array. We need to make sure this is true. */ + if (c->next_interface_id < ARRAY_SIZE(c->interface)) + c->interface[c->next_interface_id] = NULL; + return 0; } -- 2.7.4