commit c4c00d8e6a215020be87f6702844267e105e1f0e
author Mike Lockwood <lockwood@android.com> Sat Mar 12 12:25:11 2011 -0500
committer Mike Lockwood <lockwood@android.com> Sat Mar 12 14:06:49 2011 -0500
tree aa063bbf947710fbe1b459e0c6e754ee0f79fc07
parent 5db0897c6530502e1343a75b258868122030e4a5

libusbhost: Limit bulk transfer requests to 16384 bytes

Otherwise the kernel will return an EINVAL error

Change-Id: I906472a4128eb26c5be7865142bc4a52464cf5f8
Bug: 4065217

Signed-off-by: Mike Lockwood <lockwood@android.com>

libusbhost/usbhost.c

diff --git a/libusbhost/usbhost.c b/libusbhost/usbhost.c
index f5a7c3f..b1c967d 100644
--- a/libusbhost/usbhost.c
+++ b/libusbhost/usbhost.c
@@ -53,6 +53,9 @@
 #define USB_FS_ID_SCANNER   "/dev/bus/usb/%d/%d"
 #define USB_FS_ID_FORMAT    "/dev/bus/usb/%03d/%03d"
 
+// From drivers/usb/core/devio.c
+// I don't know why this isn't in a kernel header
+#define MAX_USBFS_BUFFER_SIZE   16384
 
 struct usb_host_context {
     int fd;
@@ -477,6 +480,10 @@
 {
     struct usbdevfs_bulktransfer  ctrl;
 
+    // need to limit request size to avoid EINVAL
+    if (length > MAX_USBFS_BUFFER_SIZE)
+        length = MAX_USBFS_BUFFER_SIZE;
+
     memset(&ctrl, 0, sizeof(ctrl));
     ctrl.ep = endpoint;
     ctrl.len = length;
@@ -531,7 +538,11 @@
 
     urb->status = -1;
     urb->buffer = req->buffer;
-    urb->buffer_length = req->buffer_length;
+    // need to limit request size to avoid EINVAL
+    if (req->buffer_length > MAX_USBFS_BUFFER_SIZE)
+        urb->buffer_length = MAX_USBFS_BUFFER_SIZE;
+    else
+        urb->buffer_length = req->buffer_length;
 
     do {
         res = ioctl(req->dev->fd, USBDEVFS_SUBMITURB, urb);