From: lyz <lyz@rock-chips.com>
Date: Thu, 12 Feb 2015 02:16:32 +0000 (+0800)
Subject: usb: dwc_otg: show warning on actual buffer length larger than
X-Git-Tag: firefly_0821_release~4263^2~47
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=b10188f8f18d45a7d39e51d3a779876a63891581;p=firefly-linux-kernel-4.4.55.git

usb: dwc_otg: show warning on actual buffer length larger than
transfer buffer length

In this case DWC_OTG controller will over-write memory space that
not belongs to this urb, it may cause kernel crash.

Signed-off-by: lyz <lyz@rock-chips.com>
---

diff --git a/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c b/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c
index e9eb036db319..24464797a2a6 100755
--- a/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c
+++ b/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c
@@ -285,6 +285,13 @@ static int _complete(dwc_otg_hcd_t *hcd, void *urb_handle,
 		}
 	}
 
+	WARN((urb->actual_length > urb->transfer_buffer_length &&
+	      usb_pipein(urb->pipe)),
+	      "DWC_OTG Transfer buffer length less than actual buffer length"
+	      "actual_length %d , buffer_length %d urb->complete %pF\n",
+	      urb->actual_length, urb->transfer_buffer_length,
+	      urb->complete);
+
 	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
 		int i;