Commit 25b70a86 authored by David Brownell's avatar David Brownell Committed by Greg Kroah-Hartman
Browse files

USB: ehci: paranoia, reject large control transfers

Some EHCI fault paths with large control transfers aren't coded.  Avoid
problems by rejecting transfers that may need two qTDs (16+ KB).  This is
mostly paranoia; even 4 KB transfers are rare, and most HCDs use lower
limits (so it's unlikely anyone would ever try such a thing).

Signed-off-by: default avatarDavid Brownell <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent 70a1c9e0
......@@ -764,8 +764,14 @@ static int ehci_urb_enqueue (
INIT_LIST_HEAD (&qtd_list);
switch (usb_pipetype (urb->pipe)) {
// case PIPE_BULK:
/* qh_completions() code doesn't handle all the fault cases
* in multi-TD control transfers. Even 1KB is rare anyway.
if (urb->transfer_buffer_length > (16 * 1024))
return -EMSGSIZE;
/* case PIPE_BULK: */
if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
return -ENOMEM;
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment