diff options
author | Aidan MacDonald <amachronic@protonmail.com> | 2021-11-09 14:12:13 +0000 |
---|---|---|
committer | Aidan MacDonald <amachronic@protonmail.com> | 2021-11-09 14:45:07 +0000 |
commit | 7af98ce6bbb1d7947da43afe0f50f35ba2397044 (patch) | |
tree | 1ff86c5a2001e217abcd8233ff503da30cc27578 /firmware/usbstack | |
parent | 9f1cab154c8ac651a6468fd0f992602e6e1673cd (diff) | |
download | rockbox-7af98ce6bbb1d7947da43afe0f50f35ba2397044.tar.gz rockbox-7af98ce6bbb1d7947da43afe0f50f35ba2397044.zip |
usb: Fix possible SET ADDRESS data corruption
The address from the packet needs to be saved before sending
the response -- after the response the request being pointed
to could get overwritten. This used to be done correctly but
I unintentionally broke it when updating the handler to the
new control request API.
Change-Id: I9b11548baf20dce44a82301731405dc8e8f1cef3
Diffstat (limited to 'firmware/usbstack')
-rw-r--r-- | firmware/usbstack/usb_core.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/firmware/usbstack/usb_core.c b/firmware/usbstack/usb_core.c index 5de892196d..738b92ed4d 100644 --- a/firmware/usbstack/usb_core.c +++ b/firmware/usbstack/usb_core.c | |||
@@ -729,6 +729,8 @@ static void usb_core_do_clear_feature(int recip, int recip_nr, int feature) | |||
729 | 729 | ||
730 | static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata) | 730 | static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata) |
731 | { | 731 | { |
732 | unsigned address; | ||
733 | |||
732 | switch(req->bRequest) { | 734 | switch(req->bRequest) { |
733 | case USB_REQ_GET_CONFIGURATION: | 735 | case USB_REQ_GET_CONFIGURATION: |
734 | logf("usb_core: GET_CONFIG"); | 736 | logf("usb_core: GET_CONFIG"); |
@@ -744,10 +746,11 @@ static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata) | |||
744 | /* NOTE: We really have no business handling this and drivers | 746 | /* NOTE: We really have no business handling this and drivers |
745 | * should just handle it themselves. We don't care beyond | 747 | * should just handle it themselves. We don't care beyond |
746 | * knowing if we've been assigned an address yet, or not. */ | 748 | * knowing if we've been assigned an address yet, or not. */ |
749 | address = req->wValue; | ||
747 | usb_drv_control_response(USB_CONTROL_ACK, NULL, 0); | 750 | usb_drv_control_response(USB_CONTROL_ACK, NULL, 0); |
748 | usb_drv_cancel_all_transfers(); | 751 | usb_drv_cancel_all_transfers(); |
749 | usb_drv_set_address(req->wValue); | 752 | usb_drv_set_address(address); |
750 | usb_core_do_set_addr(req->wValue); | 753 | usb_core_do_set_addr(address); |
751 | break; | 754 | break; |
752 | case USB_REQ_GET_DESCRIPTOR: | 755 | case USB_REQ_GET_DESCRIPTOR: |
753 | logf("usb_core: GET_DESC %d", req->wValue >> 8); | 756 | logf("usb_core: GET_DESC %d", req->wValue >> 8); |