usb: gadget: storage: check for valid USB_BULK_RESET_REQUEST wLength

The USB-IF CV compliance tester is getting stricter, and it would
be valid for it to fail a mass-storage device that accepts an
invalid USB_BULK_RESET_REQUEST request. Although it doesn't do
that yet, let's be proactive and fix that now.

Suggested by Alan Stern.

Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2 files changed, 3 insertions, 2 deletions

diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index dfd0044cc15a..c39d58860fa0 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -624,7 +624,8 @@ static int fsg_setup(struct usb_function *f,
                 if (ctrl->bRequestType !=
                     (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
                         break;
-                if (w_index != fsg->interface_number || w_value != 0)
+                if (w_index != fsg->interface_number || w_value != 0 ||
+                                w_length != 0)
                         return -EDOM;
 
                 /*
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 4314cf201420..11b5196284ae 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -859,7 +859,7 @@ static int class_setup_req(struct fsg_dev *fsg,
                         if (ctrl->bRequestType != (USB_DIR_OUT |
                                         USB_TYPE_CLASS | USB_RECIP_INTERFACE))
                                 break;
-                        if (w_index != 0 || w_value != 0) {
+                        if (w_index != 0 || w_value != 0 || w_length != 0) {
                                 value = -EDOM;
                                 break;
                         }