diff options
| author | Ross Zwisler <ross.zwisler@linux.intel.com> | 2018-02-03 00:26:26 -0700 |
|---|---|---|
| committer | Ross Zwisler <ross.zwisler@linux.intel.com> | 2018-02-03 00:26:26 -0700 |
| commit | ee95f4059a833839bf52972191b2d4c3d3cec552 (patch) | |
| tree | a1c8587d9b82e64a75dde376a90a3d69b0f4847a /drivers/usb/usbip/vudc_rx.c | |
| parent | d121f07691415df824e6b60520f782f6d13b3c81 (diff) | |
| parent | f81e1d35a6e36d30888c46283b8dd1022e847124 (diff) | |
Merge branch 'for-4.16/nfit' into libnvdimm-for-next
Diffstat (limited to 'drivers/usb/usbip/vudc_rx.c')
| -rw-r--r-- | drivers/usb/usbip/vudc_rx.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/drivers/usb/usbip/vudc_rx.c b/drivers/usb/usbip/vudc_rx.c index df1e30989148..1e8a23d92cb4 100644 --- a/drivers/usb/usbip/vudc_rx.c +++ b/drivers/usb/usbip/vudc_rx.c @@ -120,6 +120,25 @@ static int v_recv_cmd_submit(struct vudc *udc, urb_p->new = 1; urb_p->seqnum = pdu->base.seqnum; + if (urb_p->ep->type == USB_ENDPOINT_XFER_ISOC) { + /* validate packet size and number of packets */ + unsigned int maxp, packets, bytes; + + maxp = usb_endpoint_maxp(urb_p->ep->desc); + maxp *= usb_endpoint_maxp_mult(urb_p->ep->desc); + bytes = pdu->u.cmd_submit.transfer_buffer_length; + packets = DIV_ROUND_UP(bytes, maxp); + + if (pdu->u.cmd_submit.number_of_packets < 0 || + pdu->u.cmd_submit.number_of_packets > packets) { + dev_err(&udc->gadget.dev, + "CMD_SUBMIT: isoc invalid num packets %d\n", + pdu->u.cmd_submit.number_of_packets); + ret = -EMSGSIZE; + goto free_urbp; + } + } + ret = alloc_urb_from_cmd(&urb_p->urb, pdu, urb_p->ep->type); if (ret) { usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_MALLOC); |