From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.31; helo=mga06.intel.com; envelope-from=ruiyu.ni@intel.com; receiver=edk2-devel@lists.01.org Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2C58121BADAB9 for ; Mon, 15 Oct 2018 22:42:31 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Oct 2018 22:42:31 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,387,1534834800"; d="scan'208";a="81760173" Received: from ray-dev.ccr.corp.intel.com ([10.239.9.11]) by orsmga008.jf.intel.com with ESMTP; 15 Oct 2018 22:42:29 -0700 From: Ruiyu Ni To: edk2-devel@lists.01.org Cc: Jiewen Yao , Star Zeng , Hao A Wu Date: Tue, 16 Oct 2018 13:43:28 +0800 Message-Id: <20181016054335.47460-6-ruiyu.ni@intel.com> X-Mailer: git-send-email 2.16.1.windows.1 In-Reply-To: <20181016054335.47460-1-ruiyu.ni@intel.com> References: <20181016054335.47460-1-ruiyu.ni@intel.com> Subject: [PATCH v2 05/12] MdeModulePkg/Usb: Make sure data from HW is no more than expected X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2018 05:42:31 -0000 Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ruiyu Ni Cc: Jiewen Yao Cc: Star Zeng Cc: Hao A Wu Reviewed-by: Hao Wu Reviewed-by: Star Zeng --- MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c | 9 ++++++--- MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c | 7 ++++--- MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c | 9 ++++++--- 3 files changed, 16 insertions(+), 9 deletions(-) diff --git a/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c b/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c index fea6f47f4c..168280be81 100644 --- a/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c +++ b/MdeModulePkg/Bus/Pci/EhciDxe/EhciSched.c @@ -1009,9 +1009,12 @@ EhcMonitorAsyncRequests ( ProcBuf = NULL; if (Urb->Result == EFI_USB_NOERROR) { - ASSERT (Urb->Completed <= Urb->DataLen); - - ProcBuf = AllocatePool (Urb->Completed); + // + // Make sure the data received from HW is no more than expected. + // + if (Urb->Completed <= Urb->DataLen) { + ProcBuf = AllocatePool (Urb->Completed); + } if (ProcBuf == NULL) { EhcUpdateAsyncRequest (Ehc, Urb); diff --git a/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c b/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c index 90f010c998..f7510f3ec0 100644 --- a/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c +++ b/MdeModulePkg/Bus/Pci/UhciDxe/UhciSched.c @@ -2,7 +2,7 @@ The EHCI register operation routines. -Copyright (c) 2007 - 2013, Intel Corporation. All rights reserved.
+Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD License which accompanies this distribution. The full text of the license may be found at @@ -1001,11 +1001,12 @@ UhciMonitorAsyncReqList ( // // Copy the data to temporary buffer if there are some - // data transferred. We may have zero-length packet + // data transferred. We may have zero-length packet. + // Make sure the data received from HW is no more than expected. // Data = NULL; - if (QhResult.Complete != 0) { + if ((QhResult.Complete != 0) && (QhResult.Complete <= AsyncReq->DataLen)) { Data = AllocatePool (QhResult.Complete); if (Data == NULL) { diff --git a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c index 6a2ef4cd5d..166c44bf5e 100644 --- a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c +++ b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c @@ -1556,9 +1556,12 @@ XhcMonitorAsyncRequests ( // ProcBuf = NULL; if (Urb->Result == EFI_USB_NOERROR) { - ASSERT (Urb->Completed <= Urb->DataLen); - - ProcBuf = AllocateZeroPool (Urb->Completed); + // + // Make sure the data received from HW is no more than expected. + // + if (Urb->Completed <= Urb->DataLen) { + ProcBuf = AllocateZeroPool (Urb->Completed); + } if (ProcBuf == NULL) { XhcUpdateAsyncRequest (Xhc, Urb); -- 2.16.1.windows.1