USB: uhci: check buffer length to avoid memory overflow
authorChen Gang <gang.chen@asianux.com>
Wed, 23 Jan 2013 08:13:41 +0000 (16:13 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 24 Jan 2013 21:42:09 +0000 (13:42 -0800)
commit13996ca7afd5b5d7980ea013b00e3ef7cf2cefd0
tree5819c68b358a7c9fe44eee44b5e884e1bfe335ea
parentd2123fd9e1a56b8006986ed37e0aaf93ef0dd978
USB: uhci: check buffer length to avoid memory overflow

  for function uhci_sprint_schedule:
    the buffer len is MAX_OUTPUT: 64 * 1024, which may not be enough:
      may loop UHCI_NUMFRAMES times (UHCI_NUMFRAMES is 1024)
      each time of loop may get more than 64 bytes
    so need check the buffer length to avoid memory overflow

  this patch fix it like this:
    at first, make enough room for buffering the exceeding contents
    judge the contents which written whether bigger than buffer length
    if bigger (the exceeding contents will be in the exceeding buffer)
      break current work flow, and return.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/uhci-debug.c
drivers/usb/host/uhci-hcd.c
drivers/usb/host/uhci-q.c