path: root/android
diff options
authorAidan MacDonald <>2021-09-24 22:41:07 +0100
committerAidan MacDonald <>2021-10-16 21:14:42 +0100
commit24294bda15fc1c8c5e838e21f0bac5b5419e5cd2 (patch)
tree633f03121a640f7645a2de6966adc6336e95aeee /android
parenta665c1faada95e95a51072bfb78d3157ccb5fe85 (diff)
usb: ensure RX buffers are a multiple of the packet size
When performing an OUT transfer which is not a multiple of the max packet size, the last packet of the OUT transfer should be a short packet. However, there's no guarantee the host sends the expected amount of data in the final packet. The DWC2 USB controller handles this case by accepting any size packet and copying it out to memory. So if the packet is bigger than expected, it'll overrun the caller's buffer and Bad Things will happen. The USB 2.0 spec seems to endorse this behavior. Section 8.5.1 says "an ACK handshake indicates the endpoint has space for a wMaxPacketSize data payload." So it is possible that other USB controllers share the DWC2's behavior. The simplest solution is to force all USB RX buffers to be big enough to hold the transfer size, rounded up to a multiple of the max packet size. For example, a transfer of 700 bytes would require a 1024-byte buffer if the MPS = 512 bytes. Change-Id: Ibb84d2b2d53aec8800a3a7c2449f7a17480acbcf
Diffstat (limited to 'android')
0 files changed, 0 insertions, 0 deletions