system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-11 13:55:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

usb: misc: usbtest: allocate size of urb array according to user parameter

Browse source 
Allocate the size of urb pointer array according to testusb's
parameter sglen, and limits the length of sglen as MAX_SGLEN
(128 currently).

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
This commit is contained in:
Peter Chen 2015-09-01 09:47:58 +08:00 committed by Felipe Balbi
parent 95c8bc3609
commit 41d3c0b84d
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/usb/misc/usbtest.c
View file

@ -95,6 +95,7 @@ static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
dev_warn(&(tdev)->intf->dev , fmt , ## args)
#define GUARD_BYTE 0xA5
#define MAX_SGLEN 128
/*-------------------------------------------------------------------------*/
@ -1911,10 +1912,7 @@ test_iso_queue(struct usbtest_dev *dev, struct usbtest_param *param,
unsigned i;
unsigned long packets = 0;
int status = 0;
struct urb *urbs[10]; /* FIXME no limit */
if (param->sglen > 10)
return -EDOM;
struct urb *urbs[param->sglen];
memset(&context, 0, sizeof(context));
context.count = param->iterations * param->sglen;
@ -2061,6 +2059,9 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
if (param->iterations <= 0)
return -EINVAL;
if (param->sglen > MAX_SGLEN)
return -EINVAL;
if (mutex_lock_interruptible(&dev->lock))
return -ERESTARTSYS;