1 files changed, 25 insertions, 7 deletions

diff --git a/include/linux/usb.h b/include/linux/usb.h
index 0eec2689b955..001629cd1a97 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -337,6 +337,7 @@ struct usb_bus {
                                          * the ep queue on a short transfer
                                          * with the URB_SHORT_NOT_OK flag set.
                                          */
+        unsigned no_sg_constraint:1;    /* no sg constraint */
         unsigned sg_tablesize;          /* 0 or largest number of sg list entries */
 
         int devnum_next;                /* Next open device number in
@@ -684,6 +685,11 @@ static inline bool usb_device_supports_ltm(struct usb_device *udev)
         return udev->bos->ss_cap->bmAttributes & USB_LTM_SUPPORT;
 }
 
+static inline bool usb_device_no_sg_constraint(struct usb_device *udev)
+{
+        return udev && udev->bus && udev->bus->no_sg_constraint;
+}
+
 
 /*-------------------------------------------------------------------------*/
 
@@ -708,7 +714,10 @@ extern int usb_driver_claim_interface(struct usb_driver *driver,
  * usb_interface_claimed - returns true iff an interface is claimed
  * @iface: the interface being checked
  *
- * Returns true (nonzero) iff the interface is claimed, else false (zero).
+ * Return: %true (nonzero) iff the interface is claimed, else %false
+ * (zero).
+ *
+ * Note:
  * Callers must own the driver model's usb bus readlock.  So driver
  * probe() entries don't need extra locking, but other call contexts
  * may need to explicitly claim that lock.
@@ -745,8 +754,9 @@ extern struct usb_host_interface *usb_find_alt_setting(
  * @buf: where to put the string
  * @size: how big is "buf"?
  *
- * Returns length of the string (> 0) or negative if size was too small.
+ * Return: Length of the string (> 0) or negative if size was too small.
  *
+ * Note:
  * This identifier is intended to be "stable", reflecting physical paths in
  * hardware such as physical bus addresses for host controllers or ports on
  * USB hubs.  That makes it stay the same until systems are physically
@@ -1247,7 +1257,9 @@ typedef void (*usb_complete_t)(struct urb *);
  *      the device driver is saying that it provided this DMA address,
  *      which the host controller driver should use in preference to the
  *      transfer_buffer.
- * @sg: scatter gather buffer list
+ * @sg: scatter gather buffer list, the buffer size of each element in
+ *      the list (except the last) must be divisible by the endpoint's
+ *      max packet size if no_sg_constraint isn't set in 'struct usb_bus'
  * @num_mapped_sgs: (internal) number of mapped sg entries
  * @num_sgs: number of entries in the sg list
  * @transfer_buffer_length: How big is transfer_buffer.  The transfer may
@@ -1534,10 +1546,16 @@ static inline void usb_fill_int_urb(struct urb *urb,
         urb->transfer_buffer_length = buffer_length;
         urb->complete = complete_fn;
         urb->context = context;
-        if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER)
+
+        if (dev->speed == USB_SPEED_HIGH || dev->speed == USB_SPEED_SUPER) {
+                /* make sure interval is within allowed range */
+                interval = clamp(interval, 1, 16);
+
                 urb->interval = 1 << (interval - 1);
-        else
+        } else {
                 urb->interval = interval;
+        }
+
         urb->start_frame = -1;
 }
 
@@ -1570,7 +1588,7 @@ extern int usb_anchor_empty(struct usb_anchor *anchor);
  * usb_urb_dir_in - check if an URB describes an IN transfer
  * @urb: URB to be checked
  *
- * Returns 1 if @urb describes an IN transfer (device-to-host),
+ * Return: 1 if @urb describes an IN transfer (device-to-host),
  * otherwise 0.
  */
 static inline int usb_urb_dir_in(struct urb *urb)
@@ -1582,7 +1600,7 @@ static inline int usb_urb_dir_in(struct urb *urb)
  * usb_urb_dir_out - check if an URB describes an OUT transfer
  * @urb: URB to be checked
  *
- * Returns 1 if @urb describes an OUT transfer (host-to-device),
+ * Return: 1 if @urb describes an OUT transfer (host-to-device),
  * otherwise 0.
  */
 static inline int usb_urb_dir_out(struct urb *urb)