leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

USB: ehci: paranoia, reject large control transfers

Browse Source 
Some EHCI fault paths with large control transfers aren't coded.  Avoid
problems by rejecting transfers that may need two qTDs (16+ KB).  This is
mostly paranoia; even 4 KB transfers are rare, and most HCDs use lower
limits (so it's unlikely anyone would ever try such a thing).

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
David Brownell 2008-03-04 15:11:07 -08:00 committed by Greg Kroah-Hartman
parent 70a1c9e086
commit 25b70a8665
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/usb/host/ehci-hcd.c
View File

@ -764,8 +764,14 @@ static int ehci_urb_enqueue (
INIT_LIST_HEAD (&qtd_list); INIT_LIST_HEAD (&qtd_list);
switch (usb_pipetype (urb->pipe)) { switch (usb_pipetype (urb->pipe)) {
// case PIPE_CONTROL: case PIPE_CONTROL:
// case PIPE_BULK: /* qh_completions() code doesn't handle all the fault cases
* in multi-TD control transfers. Even 1KB is rare anyway.
*/
if (urb->transfer_buffer_length > (16 * 1024))
return -EMSGSIZE;
/* FALLTHROUGH */
/* case PIPE_BULK: */
default: default:
if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags)) if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
return -ENOMEM; return -ENOMEM;