u-boot.git/drivers/usb/gadget, branch v2023.01

usb: gadget: rndis: Prevent InformationBufferOffset manipulation

2022-12-08T13:30:39Z

Prevent access to arbitrary memory locations in gen_ndis_set_resp via manipulation of buf->InformationBufferOffset. Original implementation permits manipulation of InformationBufferOffset to exploit OID_GEN_CURRENT_PACKET_FILTER to set arbitrary memory contents within a 32byte offset as the devices packet filter. The packet filter value may be next retrieved using gen_ndis_query_resp so it is possible to extract specific memory regions two bytes a time. The rndis_query_response was not modified as neither the buffer offset nor length passed to gen_ndis_query_resp is used. Signed-off-by: Szymon Heidrich

usb: gadget: dfu: Fix check of transfer direction

2022-12-08T13:30:39Z

Commit fbce985e28eaca3af82afecc11961aadaf971a7e to fix CVE-2022-2347 blocks DFU usb requests. The verification of the transfer direction was done by an equality but it is a bit mask. Signed-off-by: Hugo SIMELIERE Reviewed-by: Fabio Estevam Reviewed-by: Sultan Qasim Khan Reviewed-by: Marek Vasut Tested-by: Marek Vasut

usb: gadget: dfu: Fix the unchecked length field

2022-11-21T14:23:00Z

DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction. Fixing the length and transfer direction. CVE-2022-2347 Signed-off-by: Venkatesh Yadav Abbarapu Reviewed-by: Marek Vasut

usb: ether: Fix error handling in usb_ether_init

2022-10-18T03:17:12Z

The code checks the return value from uclass_first_device as well as that the device exists but it passes on the return value which may be zero if there are no gadget devices. Just check that a device was returned and return -ENODEV otherwise. Also remove the dev variable which is not really used for anything. Signed-off-by: Michal Suchanek Reviewed-by: Simon Glass

Fix typo in CONFIG_USBNET_DEVADDR

2022-10-12T15:11:19Z

Fix typo that was caused by the same feature being split in to 2 different configuration options. Replace CONFIG_USBNET_DEVADDR with CONFIG_USBNET_DEV_ADDR Signed-off-by: Ignacio Zamora

usb: gadget: fastboot: detach usb on reboot commands

2022-10-10T16:08:18Z

When host issues "fastboot reboot fastboot", it's expected that the board drops the USB connection before resetting. On some boards, such as Khadas VIM3L and SEI610, this is not the case. We observe the following error: $ fastboot reboot fastboot Rebooting into fastboot OKAY [ 0.004s] fastboot: error: Failed to boot into userspace fastboot; one or more components might be unbootable. This does not happen when we use the RST button on the board. It can be reproduced in linux with: # echo b > /proc/sysrq-trigger In this case, we hit a undefined hardware behavior, where D+ and D- are in an unknown state. Therefore the host can't detect usb disconnection. Make sure we always call usb_gadget_release() when a "fastboot reboot" command is issued. Note: usb_gadget_release() should be called before g_dnl_unregister() because g_dnl_unregister() triggers a complete() call on each endpoint (thus calling do_reset()). Signed-off-by: Mattijs Korpershoek

usb: gadget: Clean up Makefile ifdeffery

2022-10-10T16:08:18Z

Take the USB_ETHER ifdef block apart and make use of obj-$(VAR) instead to include the source files in build. The duplicate CI_UDC entry is now removed, the USB_DEVICE ifdef is now reduced to core.o ep.o addition, the ether.o can be conditionally compiled in using USB_ETHER. No functional change. Signed-off-by: Marek Vasut Reviewed-by: Patrice Chotard

Merge branch 'next'

2022-10-03T19:39:46Z

treewide: Drop image_header_t typedef

2022-09-29T20:07:57Z

This is not needed and we should avoid typedefs. Use the struct instead and rename it to indicate that it really is a legacy struct. Signed-off-by: Simon Glass

Merge branch 'next' of https://gitlab.denx.de/u-boot/custodians/u-boot-riscv into next

2022-09-26T15:27:30Z