From d30b2a208108a0b0fdeae7006b8824d9be16ca96 Mon Sep 17 00:00:00 2001 From: Sarah Sharp Date: Tue, 23 Nov 2010 10:42:22 -0800 Subject: xhci: Limit roothub ports to 15 USB3 & 31 USB2 ports. The USB core allocates a USB 2.0 roothub descriptor that has room for 31 (USB_MAXCHILDREN) ports' worth of DeviceRemovable and PortPwrCtrlMask fields. Limit the number of USB 2.0 roothub ports accordingly. I don't expect to run into this limitation ever, but this prevents a buffer overflow issue in the roothub descriptor filling code. Similarly, a USB 3.0 hub can only have 15 downstream ports, so limit the USB 3.0 roothub to 15 USB 3.0 ports. Signed-off-by: Sarah Sharp --- drivers/usb/host/xhci-mem.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'drivers/usb') diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 180a2abbc868..71fd8bd287fe 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -1803,6 +1803,20 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) } xhci_dbg(xhci, "Found %u USB 2.0 ports and %u USB 3.0 ports.\n", xhci->num_usb2_ports, xhci->num_usb3_ports); + + /* Place limits on the number of roothub ports so that the hub + * descriptors aren't longer than the USB core will allocate. + */ + if (xhci->num_usb3_ports > 15) { + xhci_dbg(xhci, "Limiting USB 3.0 roothub ports to 15.\n"); + xhci->num_usb3_ports = 15; + } + if (xhci->num_usb2_ports > USB_MAXCHILDREN) { + xhci_dbg(xhci, "Limiting USB 2.0 roothub ports to %u.\n", + USB_MAXCHILDREN); + xhci->num_usb2_ports = USB_MAXCHILDREN; + } + /* * Note we could have all USB 3.0 ports, or all USB 2.0 ports. * Not sure how the USB core will handle a hub with no ports... @@ -1827,6 +1841,8 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) "addr = %p\n", i, xhci->usb2_ports[port_index]); port_index++; + if (port_index == xhci->num_usb2_ports) + break; } } if (xhci->num_usb3_ports) { @@ -1845,6 +1861,8 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags) "addr = %p\n", i, xhci->usb3_ports[port_index]); port_index++; + if (port_index == xhci->num_usb3_ports) + break; } } return 0; -- cgit v1.2.3