This patch adds additional checking to usb_submit_urb() for control and
isochronous transfers. It also adjusts the pipe value for control URBs to
match the direction in the bRequestType field of the setup packet.
If nothing seems wrong, please apply.
Alan Stern
===== urb.c 1.35 vs edited =====
--- 1.35/drivers/usb/core/urb.c Mon Aug 4 13:47:05 2003
+++ edited/drivers/usb/core/urb.c Thu Aug 21 13:57:46 2003
@@ -232,7 +232,7 @@
temp = usb_pipetype (pipe);
is_out = usb_pipeout (pipe);
- if (!usb_pipecontrol (pipe) && dev->state < USB_STATE_CONFIGURED)
+ if (usb_pipeendpoint(pipe) != 0 && dev->state < USB_STATE_CONFIGURED)
return -ENODEV;
/* (actually HCDs may need to duplicate this, endpoint might yet
@@ -242,6 +242,27 @@
if (usb_endpoint_halted (dev, usb_pipeendpoint (pipe), is_out))
return -EPIPE;
+ /* for control transfers, check the transfer length and
+ * adjust the pipe direction for the HCD
+ */
+ if (temp == PIPE_CONTROL) {
+ struct usb_ctrlrequest *setup =
+ (struct usb_ctrlrequest *) urb->setup_packet;
+
+ if (!setup)
+ return -EINVAL;
+ if (urb->transfer_buffer_length != le16_to_cpu(setup->wLength))
+ return -EMSGSIZE;
+ if (urb->transfer_buffer_length > 0 &&
+ (setup->bRequestType & USB_DIR_IN)) {
+ urb->pipe = pipe |= USB_DIR_IN;
+ is_out = 0;
+ } else {
+ urb->pipe = pipe &= ~USB_DIR_IN;
+ is_out = 1;
+ }
+ }
+
/* FIXME there should be a sharable lock protecting us against
* config/altsetting changes and disconnects, kicking in here.
* (here == before maxpacket, and eventually endpoint type,
@@ -275,12 +296,20 @@
if (urb->number_of_packets <= 0)
return -EINVAL;
for (n = 0; n < urb->number_of_packets; n++) {
- len = urb->iso_frame_desc [n].length;
+ struct usb_iso_packet_descriptor *isopd =
+ &urb->iso_frame_desc [n];
+
+ len = isopd->length;
if (len < 0 || len > max)
return -EMSGSIZE;
- urb->iso_frame_desc [n].status = -EXDEV;
- urb->iso_frame_desc [n].actual_length = 0;
+ if (isopd->offset > urb->transfer_buffer_length ||
+ len > urb->transfer_buffer_length -
+ isopd->offset)
+ return -EMSGSIZE;
+ isopd->status = -EXDEV;
+ isopd->actual_length = 0;
}
+ urb->error_count = 0;
}
/* the I/O buffer must be mapped/unmapped, except when length=0 */
-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
