summaryrefslogtreecommitdiff
path: root/drivers/usb/gadget/f_rndis.c
diff options
context:
space:
mode:
authorFelipe Balbi <balbi@ti.com>2011-05-13 17:53:48 +0400
committerGreg Kroah-Hartman <gregkh@suse.de>2011-05-14 02:51:09 +0400
commit472b91274a6c6857877b5caddb875dcb5ecdfcb8 (patch)
tree66d78459ecd7c7a42e739501bba2b8f5918b180c /drivers/usb/gadget/f_rndis.c
parentbf1f0a05d472e33dda8e5e69525be1584cdbd03a (diff)
downloadlinux-472b91274a6c6857877b5caddb875dcb5ecdfcb8.tar.xz
usb: gadget: rndis: don't test against req->length
composite.c always sets req->length to zero and expects function driver's setup handlers to return the amount of bytes to be used on req->length. If we test against req->length w_length will always be greater than req->length thus making us always stall that particular SEND_ENCAPSULATED_COMMAND request. Tested against a Windows XP SP3. Signed-off-by: Felipe Balbi <balbi@ti.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/gadget/f_rndis.c')
-rw-r--r--drivers/usb/gadget/f_rndis.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 882484a40398..fa12ec8364ef 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -420,8 +420,7 @@ rndis_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
*/
case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8)
| USB_CDC_SEND_ENCAPSULATED_COMMAND:
- if (w_length > req->length || w_value
- || w_index != rndis->ctrl_id)
+ if (w_value || w_index != rndis->ctrl_id)
goto invalid;
/* read the request; process it later */
value = w_length;