Commit b3a3dd07 authored by Daniel Mack's avatar Daniel Mack Committed by Greg Kroah-Hartman

USB: fix gathering of interface associations

TEAC's UD-H01 (and probably other devices) have a gap in the interface
number allocation of their descriptors:

  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          220
    bNumInterfaces          3
    [...]
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      [...]
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         2
      bInterfaceCount         2
      bFunctionClass          1 Audio
      bFunctionSubClass       0
      bFunctionProtocol      32
      iFunction               4
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      [...]

Once a configuration is selected, usb_set_configuration() walks the
known interfaces of a given configuration and calls find_iad() on
each of them to set the interface association pointer the interface
is included in.

The problem here is that the loop variable is taken for the interface
number in the comparison logic that gathers the association. Which is
fine as long as the descriptors are sane.

In the case above, however, the logic gets out of sync and the
interface association fields of all interfaces beyond the interface
number gap are wrong.

Fix this by passing the interface's bInterfaceNumber to find_iad()
instead.
Signed-off-by: default avatarDaniel Mack <zonque@gmail.com>
Reported-by: default avatarbEN <ml_all@circa.be>
Reported-by: default avatarIvan Perrone <ivanperrone@hotmail.com>
Tested-by: default avatarivan perrone <ivanperrone@hotmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5897b038
...@@ -1838,7 +1838,6 @@ int usb_set_configuration(struct usb_device *dev, int configuration) ...@@ -1838,7 +1838,6 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
intfc = cp->intf_cache[i]; intfc = cp->intf_cache[i];
intf->altsetting = intfc->altsetting; intf->altsetting = intfc->altsetting;
intf->num_altsetting = intfc->num_altsetting; intf->num_altsetting = intfc->num_altsetting;
intf->intf_assoc = find_iad(dev, cp, i);
kref_get(&intfc->ref); kref_get(&intfc->ref);
alt = usb_altnum_to_altsetting(intf, 0); alt = usb_altnum_to_altsetting(intf, 0);
...@@ -1851,6 +1850,8 @@ int usb_set_configuration(struct usb_device *dev, int configuration) ...@@ -1851,6 +1850,8 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
if (!alt) if (!alt)
alt = &intf->altsetting[0]; alt = &intf->altsetting[0];
intf->intf_assoc =
find_iad(dev, cp, alt->desc.bInterfaceNumber);
intf->cur_altsetting = alt; intf->cur_altsetting = alt;
usb_enable_interface(dev, intf, true); usb_enable_interface(dev, intf, true);
intf->dev.parent = &dev->dev; intf->dev.parent = &dev->dev;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment