USB: serial drivers need to use larger bulk-in buffers

When a driver doesn't know how much data a device is going to send,
the buffer size should be at least as big as the endpoint's maxpacket
value.  The serial drivers don't follow this rule; many of them
request only 256-byte bulk-in buffers.  As a result, they suffer
overflow errors if a high-speed device wants to send a lot of data,
because high-speed bulk endpoints are required to have a maxpacket
size of 512.

This patch (as1450) fixes the problem by using the driver's
bulk_in_size value as a minimum, always allocating buffers no smaller
than the endpoint's maxpacket size.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Flynn Marquardt <flynn@flynnux.de>
CC: <stable@kernel.org> [after .39-rc1 is out]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2 files changed, 4 insertions, 4 deletions

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 546a52179bec..2ff90a9c8f47 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -911,9 +911,8 @@ int usb_serial_probe(struct usb_interface *interface,
                         dev_err(&interface->dev, "No free urbs available\n");
                         goto probe_error;
                 }
-                buffer_size = serial->type->bulk_in_size;
-                if (!buffer_size)
-                        buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+                buffer_size = max_t(int, serial->type->bulk_in_size,
+                                le16_to_cpu(endpoint->wMaxPacketSize));
                 port->bulk_in_size = buffer_size;
                 port->bulk_in_endpointAddress = endpoint->bEndpointAddress;
                 port->bulk_in_buffer = kmalloc(buffer_size, GFP_KERNEL);
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index c9049139a7a5..45f3b9db4258 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -191,7 +191,8 @@ static inline void usb_set_serial_data(struct usb_serial *serial, void *data)
  * @id_table: pointer to a list of usb_device_id structures that define all
  *      of the devices this structure can support.
  * @num_ports: the number of different ports this device will have.
- * @bulk_in_size: bytes to allocate for bulk-in buffer (0 = end-point size)
+ * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer
+ *      (0 = end-point size)
  * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size)
  * @calc_num_ports: pointer to a function to determine how many ports this
  *      device has dynamically.  It will be called after the probe()