ChangeSet 1.1807.48.52, 2004/08/09 13:55:04-07:00, [EMAIL PROTECTED]
[PATCH] USB: usbfs: check the buffer size in proc_bulk
Use the same check as proc_submiturb.
Signed-off-by: Duncan Sands <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
drivers/usb/core/devio.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff -Nru a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
--- a/drivers/usb/core/devio.c 2004-08-23 13:17:22 -07:00
+++ b/drivers/usb/core/devio.c 2004-08-23 13:17:22 -07:00
@@ -72,6 +72,8 @@
} while (0)
+#define MAX_USBFS_BUFFER_SIZE 16384
+
static inline int connected (struct usb_device *dev)
{
return dev->state != USB_STATE_NOTATTACHED;
@@ -623,6 +625,8 @@
if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN)))
return -EINVAL;
len1 = bulk.len;
+ if (len1 > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
if (!(tbuf = kmalloc(len1, GFP_KERNEL)))
return -ENOMEM;
tmo = (bulk.timeout * HZ + 999) / 1000;
@@ -857,7 +861,7 @@
case USBDEVFS_URB_TYPE_BULK:
uurb.number_of_packets = 0;
- if (uurb.buffer_length > 16384)
+ if (uurb.buffer_length > MAX_USBFS_BUFFER_SIZE)
return -EINVAL;
if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE :
VERIFY_READ, uurb.buffer, uurb.buffer_length))
return -EFAULT;
@@ -899,7 +903,7 @@
interval = 1 << min (15, ep_desc->bInterval - 1);
else
interval = ep_desc->bInterval;
- if (uurb.buffer_length > 16384)
+ if (uurb.buffer_length > MAX_USBFS_BUFFER_SIZE)
return -EINVAL;
if (!access_ok((uurb.endpoint & USB_DIR_IN) ? VERIFY_WRITE :
VERIFY_READ, uurb.buffer, uurb.buffer_length))
return -EFAULT;
-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
