From: Peter Chen Date: Tue, 1 Sep 2015 01:47:58 +0000 (+0800) Subject: usb: misc: usbtest: allocate size of urb array according to user parameter X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=41d3c0b84d6e084865c429b1b6825256c0169319;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git usb: misc: usbtest: allocate size of urb array according to user parameter Allocate the size of urb pointer array according to testusb's parameter sglen, and limits the length of sglen as MAX_SGLEN (128 currently). Acked-by: Michal Nazarewicz Signed-off-by: Peter Chen Signed-off-by: Felipe Balbi --- diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c index 9517812a50e2..8f294d716369 100644 --- a/drivers/usb/misc/usbtest.c +++ b/drivers/usb/misc/usbtest.c @@ -95,6 +95,7 @@ static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test) dev_warn(&(tdev)->intf->dev , fmt , ## args) #define GUARD_BYTE 0xA5 +#define MAX_SGLEN 128 /*-------------------------------------------------------------------------*/ @@ -1911,10 +1912,7 @@ test_iso_queue(struct usbtest_dev *dev, struct usbtest_param *param, unsigned i; unsigned long packets = 0; int status = 0; - struct urb *urbs[10]; /* FIXME no limit */ - - if (param->sglen > 10) - return -EDOM; + struct urb *urbs[param->sglen]; memset(&context, 0, sizeof(context)); context.count = param->iterations * param->sglen; @@ -2061,6 +2059,9 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf) if (param->iterations <= 0) return -EINVAL; + if (param->sglen > MAX_SGLEN) + return -EINVAL; + if (mutex_lock_interruptible(&dev->lock)) return -ERESTARTSYS;