From 42189d854f174e7b29e0fdb4da9984ba63126a92 Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Tue, 2 Jul 2013 10:50:15 +0300 Subject: usb: clamp bInterval to allowed range bInterval must be within the range 1 - 16 when running at High/Super speed, and within the range 1 - 255 when running at Full/Low speed. In order to catch drivers passing a too large bInterval on Super/High speed scenarios (thus overflowing urb->interval), let's clamp() the argument to the allowed ranges. Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- include/linux/usb.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'include/linux/usb.h') diff --git a/include/linux/usb.h b/include/linux/usb.h index e99b2a114af4..eb4252a0da7e 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -1547,10 +1547,16 @@ static inline void usb_fill_int_urb(struct urb *urb, urb->transfer_buffer_length = buffer_length; urb->complete = complete_fn; urb->context = context; - if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) + + if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) { + /* make sure interval is within allowed range */ + interval = clamp(interval, 1, 16); + urb->interval = 1 << (interval - 1); - else + } else { urb->interval = interval; + } + urb->start_frame = -1; } -- cgit v1.2.3