diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2015-07-12 12:54:32 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2015-07-12 12:54:32 +0000 |
| commit | 565809c588fcf70b130aaa73649cf665eb7550dc (patch) | |
| tree | 81bfe3672c449376cde29739e75d8d74265cf508 /sys/dev | |
| parent | f68fecda59044a0112c14f8959ba9b774c6377e3 (diff) | |
Do not trust the hardware when it says that the number of remaining
bytes to transfer is superior to the length of the transfer.
Found by krw@ with an ETRON controller.
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/usb/xhci.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c index 4243a6661d8..a1e97951f28 100644 --- a/sys/dev/usb/xhci.c +++ b/sys/dev/usb/xhci.c @@ -1,4 +1,4 @@ -/* $OpenBSD: xhci.c,v 1.62 2015/06/29 18:33:23 mpi Exp $ */ +/* $OpenBSD: xhci.c,v 1.63 2015/07/12 12:54:31 mpi Exp $ */ /* * Copyright (c) 2014-2015 Martin Pieuchot @@ -746,6 +746,9 @@ xhci_event_xfer(struct xhci_softc *sc, uint64_t paddr, uint32_t status, return; } + if (remain > xfer->length) + remain = xfer->length; + switch (code) { case XHCI_CODE_SUCCESS: /* |