Commit 42189d85 authored Jul 02, 2013 by Felipe Balbi Committed by Greg Kroah-Hartman Jul 25, 2013

usb: clamp bInterval to allowed range



bInterval must be within the range 1 - 16
when running at High/Super speed, and within
the range 1 - 255 when running at Full/Low speed.

In order to catch drivers passing a too
large bInterval on Super/High speed scenarios
(thus overflowing urb->interval), let's clamp()
the argument to the allowed ranges.

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent afb8aae8

include/linux/usb.h

+8 −2

Original line number	Diff line number	Diff line
		@@ -1547,10 +1547,16 @@ static inline void usb_fill_int_urb(struct urb *urb,
		urb->transfer_buffer_length = buffer_length;
		urb->complete = complete_fn;
		urb->context = context;
		if (dev->speed == USB_SPEED_HIGH \|\| dev->speed == USB_SPEED_SUPER)

		if (dev->speed == USB_SPEED_HIGH \|\| dev->speed == USB_SPEED_SUPER) {
		/* make sure interval is within allowed range */
		interval = clamp(interval, 1, 16);

		urb->interval = 1 << (interval - 1);
		else
		} else {
		urb->interval = interval;
		}

		urb->start_frame = -1;
		}