[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/5] usb-linux.c: allow full-size control transfers,
From: |
Ian Jackson |
Subject: |
[Qemu-devel] [PATCH 1/5] usb-linux.c: allow full-size control transfers, do not overrun buffer |
Date: |
Tue, 3 Feb 2009 16:46:31 +0000 |
The buffer in struct ctrl_struct needs to be big enough for any
control transfer which may be initiated by the guest, since we are
perhaps trying to pass a device through. The biggest possible size is
2^16-1 since the length fields are 16 bits.
Also, assert that the transfer request we are about to make to our
host kernel will not overrun the buffer.
Signed-off-by: Ian Jackson <address@hidden>
---
usb-linux.c | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/usb-linux.c b/usb-linux.c
index fb1153b..321c1db 100644
--- a/usb-linux.c
+++ b/usb-linux.c
@@ -34,6 +34,8 @@
#include "qemu-timer.h"
#include "console.h"
+#if defined(__linux__)
+#include <assert.h>
#include <dirent.h>
#include <sys/ioctl.h>
#include <signal.h>
@@ -115,7 +117,7 @@ struct ctrl_struct {
uint16_t offset;
uint8_t state;
struct usb_ctrlrequest req;
- uint8_t buffer[1024];
+ uint8_t buffer[65536];
};
typedef struct USBHostDevice {
@@ -603,6 +605,8 @@ static int usb_host_handle_control(USBHostDevice *s,
USBPacket *p)
urb->type = USBDEVFS_URB_TYPE_CONTROL;
urb->endpoint = p->devep;
+ assert(s->ctrl.len < sizeof(s->ctrl.buffer));
+
urb->buffer = &s->ctrl.req;
urb->buffer_length = 8 + s->ctrl.len;
--
1.4.4.4
- [Qemu-devel] [PATCH 1/5] usb-linux.c: allow full-size control transfers, do not overrun buffer,
Ian Jackson <=
- [Qemu-devel] [PATCH 5/5] usb-linux.c: fix handling of asynchronous isochronous completion, Ian Jackson, 2009/02/05
- [Qemu-devel] [PATCH 3/5] usb-linux.c: somewhat improve some error and debugging messages, Ian Jackson, 2009/02/05
- [Qemu-devel] [PATCH 2/5] usb-linux.c: set urb->type correctly for control and interrupt transfers, Ian Jackson, 2009/02/05
- [Qemu-devel] [PATCH 4/5] usb-linux.c: more improved debugging messages (endpoint table), Ian Jackson, 2009/02/05
- Re: [Qemu-devel] [PATCH 1/5] usb-linux.c: allow full-size control transfers, do not overrun buffer, malc, 2009/02/05