tree ee47a4d8594339843d537c5cea8e2df1bf9b353a
parent 8ed9c2744b2925a670e1cacb329cf26029bad6b0
author Chris Wulff <Chris.Wulff@biamp.com> 1713895335 +0000
committer Vegard Nossum <vegard.nossum@oracle.com> 1717418850 +0000

usb: gadget: f_fs: Fix a race condition when processing setup packets.

commit 0aea736ddb877b93f6d2dd8cf439840d6b4970a9 upstream.

If the USB driver passes a pointer into the TRB buffer for creq, this
buffer can be overwritten with the status response as soon as the event
is queued. This can make the final check return USB_GADGET_DELAYED_STATUS
when it shouldn't. Instead use the stored wLength.

Fixes: 4d644abf2569 ("usb: gadget: f_fs: Only return delayed status when len is 0")
Cc: stable <stable@kernel.org>
Signed-off-by: Chris Wulff <chris.wulff@biamp.com>
Link: https://lore.kernel.org/r/CO1PR17MB5419BD664264A558B2395E28E1112@CO1PR17MB5419.namprd17.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit af3f22e07de457965352950d1a535edbf84444f0)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>