Re: usbfs and MAX_USBFS_BUFFER_SIZE
Alan Stern <stern-nwvwT67g6+6dFdvTe/[email protected]>
| Newsgroups | gmane.linux.usb.general,gmane.linux.usb.devel |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 2 Dec 2007, Daniel Drake wrote:
> Pete Zaitcev wrote:
> > The control should be limited to a page. It is preposterous to think
> > of anyone trying to send a control message with a buffer bigger than
> > a couple hundred bytes, a thousand at most. If you managed to trick
> > USBDEVFS_CONTROL into sending more than 16KB at a go, a check must be
> > missing somewhere.
>
> Fair argument. I haven't actually tried sending a big urb through
> USBDEVFS_CONTROL but I noticed that MAX_USBFS_BUFFER_SIZE is not checked
> in that codepath. I wonder if something else in the chain will reject
> big control urbs.
There's this in proc_control():
if (ctrl.wLength > PAGE_SIZE)
return -EINVAL;
Alan Stern
-
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html