Commit 393cbb51 authored by Matthias Dellweg's avatar Matthias Dellweg Committed by Greg Kroah-Hartman

usb/core/devio.c: Check for printer class specific request

In the usb printer class specific request get_device_id the value of
wIndex is (interface << 8 | altsetting) instead of just interface.
This enables the detection of some printers with libusb.
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarMatthias Dellweg <2500@gmx.de>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent aec01c58
...@@ -609,9 +609,10 @@ static int findintfep(struct usb_device *dev, unsigned int ep) ...@@ -609,9 +609,10 @@ static int findintfep(struct usb_device *dev, unsigned int ep)
} }
static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
unsigned int index) unsigned int request, unsigned int index)
{ {
int ret = 0; int ret = 0;
struct usb_host_interface *alt_setting;
if (ps->dev->state != USB_STATE_UNAUTHENTICATED if (ps->dev->state != USB_STATE_UNAUTHENTICATED
&& ps->dev->state != USB_STATE_ADDRESS && ps->dev->state != USB_STATE_ADDRESS
...@@ -620,6 +621,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, ...@@ -620,6 +621,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype)) if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
return 0; return 0;
/*
* check for the special corner case 'get_device_id' in the printer
* class specification, where wIndex is (interface << 8 | altsetting)
* instead of just interface
*/
if (requesttype == 0xa1 && request == 0) {
alt_setting = usb_find_alt_setting(ps->dev->actconfig,
index >> 8, index & 0xff);
if (alt_setting
&& alt_setting->desc.bInterfaceClass == USB_CLASS_PRINTER)
index >>= 8;
}
index &= 0xff; index &= 0xff;
switch (requesttype & USB_RECIP_MASK) { switch (requesttype & USB_RECIP_MASK) {
case USB_RECIP_ENDPOINT: case USB_RECIP_ENDPOINT:
...@@ -772,7 +786,8 @@ static int proc_control(struct dev_state *ps, void __user *arg) ...@@ -772,7 +786,8 @@ static int proc_control(struct dev_state *ps, void __user *arg)
if (copy_from_user(&ctrl, arg, sizeof(ctrl))) if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
return -EFAULT; return -EFAULT;
ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.wIndex); ret = check_ctrlrecip(ps, ctrl.bRequestType, ctrl.bRequest,
ctrl.wIndex);
if (ret) if (ret)
return ret; return ret;
wLength = ctrl.wLength; /* To suppress 64k PAGE_SIZE warning */ wLength = ctrl.wLength; /* To suppress 64k PAGE_SIZE warning */
...@@ -1102,7 +1117,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb, ...@@ -1102,7 +1117,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
kfree(dr); kfree(dr);
return -EINVAL; return -EINVAL;
} }
ret = check_ctrlrecip(ps, dr->bRequestType, ret = check_ctrlrecip(ps, dr->bRequestType, dr->bRequest,
le16_to_cpup(&dr->wIndex)); le16_to_cpup(&dr->wIndex));
if (ret) { if (ret) {
kfree(dr); kfree(dr);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment