From f9b26e4c302c90206b92679b0a15b9fada4c2262 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Fri, 8 Jan 2021 16:59:34 +0100 Subject: [PATCH] xhci: SubmitNormalRequest: divide exception on zero trbSize workaround for #16586 Change-Id: Id9d538f46b62585f4a12c3796781ae1207ed2454 Reviewed-on: https://review.haiku-os.org/c/haiku/+/3611 Reviewed-by: waddlesplash --- src/add-ons/kernel/busses/usb/xhci.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/add-ons/kernel/busses/usb/xhci.cpp b/src/add-ons/kernel/busses/usb/xhci.cpp index ce841c41f5..cccb2dcddb 100644 --- a/src/add-ons/kernel/busses/usb/xhci.cpp +++ b/src/add-ons/kernel/busses/usb/xhci.cpp @@ -810,7 +810,7 @@ XHCI::SubmitNormalRequest(Transfer *transfer) // Isochronous transfers use more specifically sized packets. trbSize = transfer->DataLength() / isochronousData->packet_count; - if (trbSize > pipe->MaxPacketSize() || trbSize + if (trbSize == 0 || trbSize > pipe->MaxPacketSize() || trbSize != (size_t)isochronousData->packet_descriptors[0].request_length) return B_BAD_VALUE; } @@ -2045,6 +2045,10 @@ XHCI::ConfigureEndpoint(xhci_endpoint* ep, uint8 slot, uint8 number, uint8 type, // The Max Burst Payload is the number of bytes moved by a // maximum sized burst. (XHCI 1.2 ยง 4.11.7.1 p236.) ep->max_burst_payload = (maxBurst + 1) * maxPacketSize; + if (ep->max_burst_payload == 0) { + TRACE_ERROR("ConfigureEndpoint() failed invalid max_burst_payload\n"); + return B_BAD_VALUE; + } // Assign average TRB length. if ((type & USB_OBJECT_CONTROL_PIPE) != 0) {