From: David Brownell Date: Tue, 4 Mar 2008 23:11:07 +0000 (-0800) Subject: USB: ehci: paranoia, reject large control transfers X-Git-Tag: v2.6.26-rc1~1061^2~71 X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=25b70a8665e9854504b9196c3098dadd37c721aa;p=~emulex%2Finfiniband.git USB: ehci: paranoia, reject large control transfers Some EHCI fault paths with large control transfers aren't coded. Avoid problems by rejecting transfers that may need two qTDs (16+ KB). This is mostly paranoia; even 4 KB transfers are rare, and most HCDs use lower limits (so it's unlikely anyone would ever try such a thing). Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index 8c3e860bfce..a02dcff5eb2 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -764,8 +764,14 @@ static int ehci_urb_enqueue ( INIT_LIST_HEAD (&qtd_list); switch (usb_pipetype (urb->pipe)) { - // case PIPE_CONTROL: - // case PIPE_BULK: + case PIPE_CONTROL: + /* qh_completions() code doesn't handle all the fault cases + * in multi-TD control transfers. Even 1KB is rare anyway. + */ + if (urb->transfer_buffer_length > (16 * 1024)) + return -EMSGSIZE; + /* FALLTHROUGH */ + /* case PIPE_BULK: */ default: if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags)) return -ENOMEM;