From b10188f8f18d45a7d39e51d3a779876a63891581 Mon Sep 17 00:00:00 2001 From: lyz Date: Thu, 12 Feb 2015 10:16:32 +0800 Subject: [PATCH] usb: dwc_otg: show warning on actual buffer length larger than transfer buffer length In this case DWC_OTG controller will over-write memory space that not belongs to this urb, it may cause kernel crash. Signed-off-by: lyz --- drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c b/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c index e9eb036db319..24464797a2a6 100755 --- a/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c +++ b/drivers/usb/dwc_otg_310/dwc_otg_hcd_linux.c @@ -285,6 +285,13 @@ static int _complete(dwc_otg_hcd_t *hcd, void *urb_handle, } } + WARN((urb->actual_length > urb->transfer_buffer_length && + usb_pipein(urb->pipe)), + "DWC_OTG Transfer buffer length less than actual buffer length" + "actual_length %d , buffer_length %d urb->complete %pF\n", + urb->actual_length, urb->transfer_buffer_length, + urb->complete); + if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) { int i; -- 2.34.1