Steve Calfee wrote: > On Wed, Mar 9, 2016 at 11:39 AM, Felipe F. Tonello <eu@xxxxxxxxxxxxxxxxx> wrote: >> [...] >> This patch fixes this problem by setting the minimum usb_request's buffer size >> for the OUT endpoint as its wMaxPacketSize. >> >> --- a/drivers/usb/gadget/function/f_midi.c >> +++ b/drivers/usb/gadget/function/f_midi.c >> @@ -366,7 +366,9 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt) >> struct usb_request *req = >> - midi_alloc_ep_req(midi->out_ep, midi->buflen); >> + midi_alloc_ep_req(midi->out_ep, >> + max_t(unsigned, midi->buflen, >> + bulk_out_desc.wMaxPacketSize)); > > Won't you get a buffer overrun if midi->buflen is less than wMaxPacketSize? No. f_midi_handle_out_data() uses only the request buffer. Regards, Clemens -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
