Merge https://source.denx.de/u-boot/custodians/u-boot-usb
- DFU and RNDIS fixes
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index 33ef62f..44877df 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -325,7 +325,7 @@
switch (ctrl->bRequest) {
case USB_REQ_DFU_DNLOAD:
- if (ctrl->bRequestType == USB_DIR_OUT) {
+ if (!(ctrl->bRequestType & USB_DIR_IN)) {
if (len == 0) {
f_dfu->dfu_state = DFU_STATE_dfuERROR;
value = RET_STALL;
@@ -337,7 +337,7 @@
}
break;
case USB_REQ_DFU_UPLOAD:
- if (ctrl->bRequestType == USB_DIR_IN) {
+ if (ctrl->bRequestType & USB_DIR_IN) {
f_dfu->dfu_state = DFU_STATE_dfuUPLOAD_IDLE;
f_dfu->blk_seq_num = 0;
value = handle_upload(req, len);
@@ -436,7 +436,7 @@
switch (ctrl->bRequest) {
case USB_REQ_DFU_DNLOAD:
- if (ctrl->bRequestType == USB_DIR_OUT) {
+ if (!(ctrl->bRequestType & USB_DIR_IN)) {
f_dfu->dfu_state = DFU_STATE_dfuDNLOAD_SYNC;
f_dfu->blk_seq_num = w_value;
value = handle_dnload(gadget, len);
@@ -527,7 +527,7 @@
switch (ctrl->bRequest) {
case USB_REQ_DFU_UPLOAD:
- if (ctrl->bRequestType == USB_DIR_IN) {
+ if (ctrl->bRequestType & USB_DIR_IN) {
/* state transition if less data then requested */
f_dfu->blk_seq_num = w_value;
value = handle_upload(req, len);
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 13c327e..3948f2c 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -855,14 +855,17 @@
rndis_set_cmplt_type *resp;
rndis_resp_t *r;
+ BufLength = get_unaligned_le32(&buf->InformationBufferLength);
+ BufOffset = get_unaligned_le32(&buf->InformationBufferOffset);
+ if ((BufOffset > RNDIS_MAX_TOTAL_SIZE - 8) ||
+ (BufLength > RNDIS_MAX_TOTAL_SIZE - 8 - BufOffset))
+ return -EINVAL;
+
r = rndis_add_response(configNr, sizeof(rndis_set_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_set_cmplt_type *) r->buf;
- BufLength = get_unaligned_le32(&buf->InformationBufferLength);
- BufOffset = get_unaligned_le32(&buf->InformationBufferOffset);
-
#ifdef VERBOSE
debug("%s: Length: %d\n", __func__, BufLength);
debug("%s: Offset: %d\n", __func__, BufOffset);
diff --git a/include/dfu.h b/include/dfu.h
index dcb9cd9..0792222 100644
--- a/include/dfu.h
+++ b/include/dfu.h
@@ -495,7 +495,7 @@
}
#endif
-#ifdef CONFIG_DFU_VIRT
+#if CONFIG_IS_ENABLED(DFU_VIRT)
int dfu_fill_entity_virt(struct dfu_entity *dfu, char *devstr,
char **argv, int argc);
int dfu_write_medium_virt(struct dfu_entity *dfu, u64 offset,