Re: usbfs and MAX_USBFS_BUFFER_SIZE

[Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>]

On Sun, 2 Dec 2007, Daniel Drake wrote:

> Pete Zaitcev wrote:
> > The control should be limited to a page. It is preposterous to think
> > of anyone trying to send a control message with a buffer bigger than
> > a couple hundred bytes, a thousand at most. If you managed to trick
> > USBDEVFS_CONTROL into sending more than 16KB at a go, a check must be
> > missing somewhere.
> 
> Fair argument. I haven't actually tried sending a big urb through 
> USBDEVFS_CONTROL but I noticed that MAX_USBFS_BUFFER_SIZE is not checked 
> in that codepath. I wonder if something else in the chain will reject 
> big control urbs.

There's this in proc_control():

        if (ctrl.wLength > PAGE_SIZE)
                return -EINVAL;

Alan Stern


-------------------------------------------------------------------------
SF.Net email is sponsored by: The Future of Linux Business White Paper
from Novell.  From the desktop to the data center, Linux is going
mainstream.  Let it simplify your IT future.
http://altfarm.mediaplex.com/ad/ck/8857-50307-18918-4
_______________________________________________
linux-usb-devel@xxxxxxxxxxxxxxxxxxxxx
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel