Use the same check as proc_submiturb.
Signed-off-by: Duncan Sands <[EMAIL PROTECTED]>
--- local_tree.orig/drivers/usb/core/devio.c 2004-08-06 09:58:21.907095209 +0200
+++ local_tree/drivers/usb/core/devio.c 2004-08-06 10:35:33.275414244 +0200
@@ -72,6 +72,8 @@
} while (0)
+#define MAX_USBFS_BUFFER_SIZE 16384
+
static inline int connected (struct usb_device *dev)
{
return dev->state != USB_STATE_NOTATTACHED;
@@ -623,6 +625,8 @@
if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
return -EINVAL;
len1 = bulk.len;
+ if (len1 > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
if (!(tbuf = kmalloc(len1, GFP_KERNEL)))
return -ENOMEM;
tmo = (bulk.timeout * HZ + 999) / 1000;
@@ -857,7 +861,7 @@
case USBDEVFS_URB_TYPE_BULK:
uurb.number_of_packets = 0;
- if (uurb.buffer_length > 16384)
+ if (uurb.buffer_length > MAX_USBFS_BUFFER_SIZE)
return -EINVAL;
if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE :
VERIFY_READ, uurb.buffer, uurb.buffer_length))
return -EFAULT;
@@ -899,7 +903,7 @@
interval = 1 << min (15, ep_desc->bInterval - 1);
else
interval = ep_desc->bInterval;
- if (uurb.buffer_length > 16384)
+ if (uurb.buffer_length > MAX_USBFS_BUFFER_SIZE)
return -EINVAL;
if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE :
VERIFY_READ, uurb.buffer, uurb.buffer_length))
return -EFAULT;
-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
