diff options
| author | Tom Rini <trini@konsulko.com> | 2022-12-08 11:24:50 -0500 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2022-12-08 11:24:50 -0500 |
| commit | 573359d14d961a317de276ace16f8151788d1f71 (patch) | |
| tree | d814bc9986580dee90d38c6fd16a829d2e97263b | |
| parent | 90609198223e9a3e4cf63e4225d3f9a3118171c9 (diff) | |
| parent | 51a0e215ec8ce9cc88f928373e9ce8303db1829b (diff) | |
| download | u-boot-573359d14d961a317de276ace16f8151788d1f71.zip u-boot-573359d14d961a317de276ace16f8151788d1f71.tar.gz u-boot-573359d14d961a317de276ace16f8151788d1f71.tar.bz2 | |
Merge https://source.denx.de/u-boot/custodians/u-boot-usb
- DFU and RNDIS fixes
| -rw-r--r-- | drivers/usb/gadget/f_dfu.c | 8 | ||||
| -rw-r--r-- | drivers/usb/gadget/rndis.c | 9 | ||||
| -rw-r--r-- | include/dfu.h | 2 |
3 files changed, 11 insertions, 8 deletions
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c index 33ef62f..44877df 100644 --- a/drivers/usb/gadget/f_dfu.c +++ b/drivers/usb/gadget/f_dfu.c @@ -325,7 +325,7 @@ static int state_dfu_idle(struct f_dfu *f_dfu, switch (ctrl->bRequest) { case USB_REQ_DFU_DNLOAD: - if (ctrl->bRequestType == USB_DIR_OUT) { + if (!(ctrl->bRequestType & USB_DIR_IN)) { if (len == 0) { f_dfu->dfu_state = DFU_STATE_dfuERROR; value = RET_STALL; @@ -337,7 +337,7 @@ static int state_dfu_idle(struct f_dfu *f_dfu, } break; case USB_REQ_DFU_UPLOAD: - if (ctrl->bRequestType == USB_DIR_IN) { + if (ctrl->bRequestType & USB_DIR_IN) { f_dfu->dfu_state = DFU_STATE_dfuUPLOAD_IDLE; f_dfu->blk_seq_num = 0; value = handle_upload(req, len); @@ -436,7 +436,7 @@ static int state_dfu_dnload_idle(struct f_dfu *f_dfu, switch (ctrl->bRequest) { case USB_REQ_DFU_DNLOAD: - if (ctrl->bRequestType == USB_DIR_OUT) { + if (!(ctrl->bRequestType & USB_DIR_IN)) { f_dfu->dfu_state = DFU_STATE_dfuDNLOAD_SYNC; f_dfu->blk_seq_num = w_value; value = handle_dnload(gadget, len); @@ -527,7 +527,7 @@ static int state_dfu_upload_idle(struct f_dfu *f_dfu, switch (ctrl->bRequest) { case USB_REQ_DFU_UPLOAD: - if (ctrl->bRequestType == USB_DIR_IN) { + if (ctrl->bRequestType & USB_DIR_IN) { /* state transition if less data then requested */ f_dfu->blk_seq_num = w_value; value = handle_upload(req, len); diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c index 13c327e..3948f2c 100644 --- a/drivers/usb/gadget/rndis.c +++ b/drivers/usb/gadget/rndis.c @@ -855,14 +855,17 @@ static int rndis_set_response(int configNr, rndis_set_msg_type *buf) rndis_set_cmplt_type *resp; rndis_resp_t *r; + BufLength = get_unaligned_le32(&buf->InformationBufferLength); + BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); + if ((BufOffset > RNDIS_MAX_TOTAL_SIZE - 8) || + (BufLength > RNDIS_MAX_TOTAL_SIZE - 8 - BufOffset)) + return -EINVAL; + r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type)); if (!r) return -ENOMEM; resp = (rndis_set_cmplt_type *) r->buf; - BufLength = get_unaligned_le32(&buf->InformationBufferLength); - BufOffset = get_unaligned_le32(&buf->InformationBufferOffset); - #ifdef VERBOSE debug("%s: Length: %d\n", __func__, BufLength); debug("%s: Offset: %d\n", __func__, BufOffset); diff --git a/include/dfu.h b/include/dfu.h index dcb9cd9..0792222 100644 --- a/include/dfu.h +++ b/include/dfu.h @@ -495,7 +495,7 @@ static inline int dfu_fill_entity_mtd(struct dfu_entity *dfu, char *devstr, } #endif -#ifdef CONFIG_DFU_VIRT +#if CONFIG_IS_ENABLED(DFU_VIRT) int dfu_fill_entity_virt(struct dfu_entity *dfu, char *devstr, char **argv, int argc); int dfu_write_medium_virt(struct dfu_entity *dfu, u64 offset, |