From: Michal Sojka <sojkam1@fel.cvut.cz>
Date: Tue, 15 Mar 2011 15:41:47 +0000 (+0100)
Subject: USB: Do not pass negative length to snoop_urb()
X-Git-Tag: android-x86-4.4-r1~6502^2~11
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=9d02b42614149ebccf12c9c580601ed01bd83070;p=android-x86%2Fkernel.git

USB: Do not pass negative length to snoop_urb()

When `echo Y > /sys/module/usbcore/parameters/usbfs_snoop` and
usb_control_msg() returns error, a lot of kernel memory is dumped to dmesg
until unhandled kernel paging request occurs.

Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index a7131ad630f9..37518dfdeb98 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -802,7 +802,7 @@ static int proc_control(struct dev_state *ps, void __user *arg)
 				    tbuf, ctrl.wLength, tmo);
 		usb_lock_device(dev);
 		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
-			tbuf, i);
+			  tbuf, max(i, 0));
 		if ((i > 0) && ctrl.wLength) {
 			if (copy_to_user(ctrl.data, tbuf, i)) {
 				free_page((unsigned long)tbuf);