usb: gadget: storage: check for valid USB_BULK_GET_MAX_LUN_REQUEST

The latest USB-IF CV tester checks for a valid length for this
request.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2 files changed, 3 insertions, 2 deletions

diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 52583a235330..dfd0044cc15a 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -639,7 +639,8 @@ static int fsg_setup(struct usb_function *f,
                 if (ctrl->bRequestType !=
                     (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
                         break;
-                if (w_index != fsg->interface_number || w_value != 0)
+                if (w_index != fsg->interface_number || w_value != 0 ||
+                                w_length != 1)
                         return -EDOM;
                 VDBG(fsg, "get max LUN\n");
                 *(u8 *)req->buf = fsg->common->nluns - 1;
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index f7e39b0365ce..4314cf201420 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -875,7 +875,7 @@ static int class_setup_req(struct fsg_dev *fsg,
                         if (ctrl->bRequestType != (USB_DIR_IN |
                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
                                 break;
-                        if (w_index != 0 || w_value != 0) {
+                        if (w_index != 0 || w_value != 0 || w_length != 1) {
                                 value = -EDOM;
                                 break;
                         }