Alan Stern 7652dd2c5c USB: core: Check buffer length matches wLength for control transfers
A type of inconsistency that can show up in control URBs is when the
setup packet's wLength value does not match the URB's
transfer_buffer_length field.  The two should always be equal;
differences could lead to information leaks or undefined behavior for
OUT transfers or overruns for IN transfers.

This patch adds a test for such mismatches during URB submission.  If
the test fails, the submission is rejected with a -EBADR error code
(which is not used elsewhere in the USB core), and a debugging message
is logged for people interested in tracking down these errors.

Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20210526153244.GA1400430@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-27 13:46:21 +02:00
..
2021-02-16 20:36:38 -08:00
2021-05-05 12:39:29 -07:00
2019-07-15 11:03:03 -03:00
2020-10-16 15:02:21 -07:00
2020-12-16 14:58:35 -08:00
2019-07-26 08:15:26 -06:00
2019-06-07 11:35:15 -06:00
2020-06-02 20:32:53 -03:00
2020-12-10 22:37:32 +01:00
2019-10-07 09:47:37 -07:00
2021-05-05 10:20:33 -06:00