summaryrefslogtreecommitdiffstats
path: root/firmware
diff options
context:
space:
mode:
authorAidan MacDonald <amachronic@protonmail.com>2021-11-09 14:12:13 +0000
committerAidan MacDonald <amachronic@protonmail.com>2021-11-09 14:45:07 +0000
commit7af98ce6bbb1d7947da43afe0f50f35ba2397044 (patch)
tree1ff86c5a2001e217abcd8233ff503da30cc27578 /firmware
parent9f1cab154c8ac651a6468fd0f992602e6e1673cd (diff)
downloadrockbox-7af98ce6bbb1d7947da43afe0f50f35ba2397044.tar.gz
rockbox-7af98ce6bbb1d7947da43afe0f50f35ba2397044.zip
usb: Fix possible SET ADDRESS data corruption
The address from the packet needs to be saved before sending the response -- after the response the request being pointed to could get overwritten. This used to be done correctly but I unintentionally broke it when updating the handler to the new control request API. Change-Id: I9b11548baf20dce44a82301731405dc8e8f1cef3
Diffstat (limited to 'firmware')
-rw-r--r--firmware/usbstack/usb_core.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/firmware/usbstack/usb_core.c b/firmware/usbstack/usb_core.c
index 5de892196d..738b92ed4d 100644
--- a/firmware/usbstack/usb_core.c
+++ b/firmware/usbstack/usb_core.c
@@ -729,6 +729,8 @@ static void usb_core_do_clear_feature(int recip, int recip_nr, int feature)
static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata)
{
+ unsigned address;
+
switch(req->bRequest) {
case USB_REQ_GET_CONFIGURATION:
logf("usb_core: GET_CONFIG");
@@ -744,10 +746,11 @@ static void request_handler_device(struct usb_ctrlrequest* req, void* reqdata)
/* NOTE: We really have no business handling this and drivers
* should just handle it themselves. We don't care beyond
* knowing if we've been assigned an address yet, or not. */
+ address = req->wValue;
usb_drv_control_response(USB_CONTROL_ACK, NULL, 0);
usb_drv_cancel_all_transfers();
- usb_drv_set_address(req->wValue);
- usb_core_do_set_addr(req->wValue);
+ usb_drv_set_address(address);
+ usb_core_do_set_addr(address);
break;
case USB_REQ_GET_DESCRIPTOR:
logf("usb_core: GET_DESC %d", req->wValue >> 8);