Nyaaori/rockbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

usb: Fix possible SET ADDRESS data corruption

Browse source 
The address from the packet needs to be saved before sending
the response -- after the response the request being pointed
to could get overwritten. This used to be done correctly but
I unintentionally broke it when updating the handler to the
new control request API.

Change-Id: I9b11548baf20dce44a82301731405dc8e8f1cef3
This commit is contained in:
Aidan MacDonald 2021-11-09 14:12:13 +00:00
parent 9f1cab154c
commit 7af98ce6bb
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
firmware/usbstack/usb_core.c
View file

@ -729,6 +729,8 @@ static void usb_core_do_clear_feature(int recip, int recip_nr, int feature)
static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata) static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata)
{ {
unsigned address;
switch(req->bRequest) { switch(req->bRequest) {
case USB_REQ_GET_CONFIGURATION: case USB_REQ_GET_CONFIGURATION:
logf("usb_core: GET_CONFIG"); logf("usb_core: GET_CONFIG");
@ -744,10 +746,11 @@ static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata)
/* NOTE: We really have no business handling this and drivers /* NOTE: We really have no business handling this and drivers
* should just handle it themselves. We don't care beyond * should just handle it themselves. We don't care beyond
* knowing if we've been assigned an address yet, or not. */ * knowing if we've been assigned an address yet, or not. */
address = req->wValue;
usb_drv_control_response(USB_CONTROL_ACK, NULL, 0); usb_drv_control_response(USB_CONTROL_ACK, NULL, 0);
usb_drv_cancel_all_transfers(); usb_drv_cancel_all_transfers();
usb_drv_set_address(req->wValue); usb_drv_set_address(address);
usb_core_do_set_addr(req->wValue); usb_core_do_set_addr(address);
break; break;
case USB_REQ_GET_DESCRIPTOR: case USB_REQ_GET_DESCRIPTOR:
logf("usb_core: GET_DESC %d", req->wValue >> 8); logf("usb_core: GET_DESC %d", req->wValue >> 8);