From: Felipe Balbi <balbi@ti.com>
Date: Tue, 2 Jul 2013 07:50:15 +0000 (+0300)
Subject: usb: clamp bInterval to allowed range
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=42189d854f174e7b29e0fdb4da9984ba63126a92;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

usb: clamp bInterval to allowed range

bInterval must be within the range 1 - 16
when running at High/Super speed, and within
the range 1 - 255 when running at Full/Low speed.

In order to catch drivers passing a too
large bInterval on Super/High speed scenarios
(thus overflowing urb->interval), let's clamp()
the argument to the allowed ranges.

Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/include/linux/usb.h b/include/linux/usb.h
index e99b2a114af4..eb4252a0da7e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1547,10 +1547,16 @@ static inline void usb_fill_int_urb(struct urb *urb,
 	urb->transfer_buffer_length = buffer_length;
 	urb->complete = complete_fn;
 	urb->context = context;
-	if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER)
+
+	if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) {
+		/* make sure interval is within allowed range */
+		interval = clamp(interval, 1, 16);
+
 		urb->interval = 1 << (interval - 1);
-	else
+	} else {
 		urb->interval = interval;
+	}
+
 	urb->start_frame = -1;
 }