diff options
| author |   mpi <mpi@openbsd.org> | 2015-07-12 12:54:31 +0000 |
|---|---|---|
| committer | mpi <mpi@openbsd.org> | 2015-07-12 12:54:31 +0000 |
| commit | 5a065a24dc54b3a3f0d0daa4b651bfb6b69b4d6c (patch) | |
| tree | 3f4ab7a0cc5a99211404dc3f929c99ed03df5825 | |
| parent | Keep one byte for terminating '\0'. (diff) | |
| download | wireguard-openbsd-5a065a24dc54b3a3f0d0daa4b651bfb6b69b4d6c.tar.xz wireguard-openbsd-5a065a24dc54b3a3f0d0daa4b651bfb6b69b4d6c.zip | |
Do not trust the hardware when it says that the number of remaining
bytes to transfer is superior to the length of the transfer.
Found by krw@ with an ETRON controller.
| -rw-r--r-- | sys/dev/usb/xhci.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c index 4243a6661d8..a1e97951f28 100644 --- a/sys/dev/usb/xhci.c +++ b/sys/dev/usb/xhci.c @@ -1,4 +1,4 @@ -/* $OpenBSD: xhci.c,v 1.62 2015/06/29 18:33:23 mpi Exp $ */ +/* $OpenBSD: xhci.c,v 1.63 2015/07/12 12:54:31 mpi Exp $ */ /* * Copyright (c) 2014-2015 Martin Pieuchot @@ -746,6 +746,9 @@ xhci_event_xfer(struct xhci_softc *sc, uint64_t paddr, uint32_t status, return; } + if (remain > xfer->length) + remain = xfer->length; + switch (code) { case XHCI_CODE_SUCCESS: /* |