summaryrefslogtreecommitdiff
path: root/include/linux
diff options
context:
space:
mode:
authorFelipe Balbi <balbi@ti.com>2013-07-02 10:50:15 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-07-25 11:49:30 -0700
commit42189d854f174e7b29e0fdb4da9984ba63126a92 (patch)
treea8f825986d951260305433938aa1e431df4fa2d2 /include/linux
parentafb8aae89890e65bd4b828de38bd430d4f31caa8 (diff)
downloadlwn-42189d854f174e7b29e0fdb4da9984ba63126a92.tar.gz
lwn-42189d854f174e7b29e0fdb4da9984ba63126a92.zip
usb: clamp bInterval to allowed range
bInterval must be within the range 1 - 16 when running at High/Super speed, and within the range 1 - 255 when running at Full/Low speed. In order to catch drivers passing a too large bInterval on Super/High speed scenarios (thus overflowing urb->interval), let's clamp() the argument to the allowed ranges. Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux')
-rw-r--r--include/linux/usb.h10
1 files changed, 8 insertions, 2 deletions
diff --git a/include/linux/usb.h b/include/linux/usb.h
index e99b2a114af4..eb4252a0da7e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1547,10 +1547,16 @@ static inline void usb_fill_int_urb(struct urb *urb,
urb->transfer_buffer_length = buffer_length;
urb->complete = complete_fn;
urb->context = context;
- if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER)
+
+ if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) {
+ /* make sure interval is within allowed range */
+ interval = clamp(interval, 1, 16);
+
urb->interval = 1 << (interval - 1);
- else
+ } else {
urb->interval = interval;
+ }
+
urb->start_frame = -1;
}