Commit 25b70a86 authored Mar 04, 2008 by David Brownell Committed by Greg Kroah-Hartman Apr 24, 2008

USB: ehci: paranoia, reject large control transfers

Some EHCI fault paths with large control transfers aren't coded. Avoid
problems by rejecting transfers that may need two qTDs (16+ KB). This is
mostly paranoia; even 4 KB transfers are rare, and most HCDs use lower
limits (so it's unlikely anyone would ever try such a thing).

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

parent 70a1c9e0

drivers/usb/host/ehci-hcd.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -764,8 +764,14 @@ static int ehci_urb_enqueue (
		INIT_LIST_HEAD (&qtd_list);

		switch (usb_pipetype (urb->pipe)) {
		// case PIPE_CONTROL:
		// case PIPE_BULK:
		case PIPE_CONTROL:
		/* qh_completions() code doesn't handle all the fault cases
		* in multi-TD control transfers. Even 1KB is rare anyway.
		*/
		if (urb->transfer_buffer_length > (16 * 1024))
		return -EMSGSIZE;
		/* FALLTHROUGH */
		/* case PIPE_BULK: */
		default:
		if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
		return -ENOMEM;