PERFORCE change 138046 for review

[Hans Petter Selasky]

http://perforce.freebsd.org/chv.cgi?CH=138046

Change 138046 by hselasky at hselasky_laptop001 on 2008/03/18 20:35:12

	
	Put an upper limit on the allowed "usbd_do_request" timeout, in case
	this value is derived from user input.

Affected files ...

.. //depot/projects/usb/src/sys/dev/usb/usb_transfer.c#121 edit

Differences ...

==== //depot/projects/usb/src/sys/dev/usb/usb_transfer.c#121 (text+ko) ====

@@ -3867,7 +3867,10 @@
  * used.
  *
  * "timeout" - gives the timeout for the control transfer in
- * milliseconds.
+ * milliseconds. A "timeout" value less than 50 milliseconds is
+ * treated like a 50 millisecond timeout. A "timeout" value greater
+ * than 30 seconds is treated like a 30 second timeout. This USB stack
+ * does not allow control requests without a timeout.
  *
  * Returns:
  *    0: Success
@@ -3892,6 +3895,10 @@
 		/* timeout is too small */
 		timeout = 50;
 	}
+	if (timeout > 30000) {
+		/* timeout is too big */
+		timeout = 30000;
+	}
 	length = UGETW(req->wLength);
 
 	PRINTFN(4, ("udev=%p bmRequestType=0x%02x bRequest=0x%02x "