1 files changed, 33 insertions, 3 deletions

diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index ac043ec2b8dc..e02c1a30c4cd 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -26,10 +26,13 @@
 
 /*
  * This limit exists to prevent OOMs when the user process stops reading.
+ * If usbmon were available to unprivileged processes, it might be open
+ * to a local DoS. But we have to keep to root in order to prevent
+ * password sniffing from HID devices.
  */
-#define EVENT_MAX  25
+#define EVENT_MAX  (2*PAGE_SIZE / sizeof(struct mon_event_text))
 
-#define PRINTF_DFL  130
+#define PRINTF_DFL  160
 
 struct mon_event_text {
         struct list_head e_link;
@@ -111,7 +114,7 @@ static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
          * number of corner cases, but it seems that the following is
          * more or less safe.
          *
-         * We do not even try to look transfer_buffer, because it can
+         * We do not even try to look at transfer_buffer, because it can
          * contain non-NULL garbage in case the upper level promised to
          * set DMA for the HCD.
          */
@@ -179,6 +182,32 @@ static void mon_text_complete(void *data, struct urb *urb)
         mon_text_event(rp, urb, 'C');
 }
 
+static void mon_text_error(void *data, struct urb *urb, int error)
+{
+        struct mon_reader_text *rp = data;
+        struct mon_event_text *ep;
+
+        if (rp->nevents >= EVENT_MAX ||
+            (ep = kmem_cache_alloc(rp->e_slab, SLAB_ATOMIC)) == NULL) {
+                rp->r.m_bus->cnt_text_lost++;
+                return;
+        }
+
+        ep->type = 'E';
+        ep->pipe = urb->pipe;
+        ep->id = (unsigned long) urb;
+        ep->tstamp = 0;
+        ep->length = 0;
+        ep->status = error;
+
+        ep->setup_flag = '-';
+        ep->data_flag = 'E';
+
+        rp->nevents++;
+        list_add_tail(&ep->e_link, &rp->e_list);
+        wake_up(&rp->wait);
+}
+
 /*
  * Fetch next event from the circular buffer.
  */
@@ -232,6 +261,7 @@ static int mon_text_open(struct inode *inode, struct file *file)
         rp->r.m_bus = mbus;
         rp->r.r_data = rp;
         rp->r.rnf_submit = mon_text_submit;
+        rp->r.rnf_error = mon_text_error;
         rp->r.rnf_complete = mon_text_complete;
 
         snprintf(rp->slab_name, SLAB_NAME_SZ, "mon%dt_%lx", ubus->busnum,