MdeModulePkg/PrintLib: Avoid reading content beyond the format string

[mirror_edk2.git] / MdeModulePkg / Bus / Pci / XhciDxe / XhciSched.c

diff --git a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
index c25342dc1f7845ffa919642bdf8bcc7ef6b94ada..4bec76a85ffbc7bac8e81fe4ccba810bde3503f6 100644 (file)
--- a/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
+++ b/MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
@@ -2,7 +2,7 @@
 \r
   XHCI transfer scheduling routines.\r
 \r
-Copyright (c) 2011 - 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2011 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -1009,7 +1009,11 @@ IsAsyncIntTrb (
         return TRUE;\r
       }\r
       CheckedTrb++;\r
-      if ((UINTN)CheckedTrb >= ((UINTN) CheckedUrb->Ring->RingSeg0 + sizeof (TRB_TEMPLATE) * CheckedUrb->Ring->TrbNumber)) {\r
+      //\r
+      // If the checked TRB is the link TRB at the end of the transfer ring,\r
+      // recircle it to the head of the ring.\r
+      //\r
+      if (CheckedTrb->Type == TRB_TYPE_LINK) {\r
         CheckedTrb = (TRB_TEMPLATE*) CheckedUrb->Ring->RingSeg0;\r
       }\r
     }\r
@@ -1163,7 +1167,7 @@ XhcCheckUrbResult (
       case TRB_COMPLETION_SHORT_PACKET:\r
       case TRB_COMPLETION_SUCCESS:\r
         if (EvtTrb->Completecode == TRB_COMPLETION_SHORT_PACKET) {\r
-          DEBUG ((EFI_D_ERROR, "XhcCheckUrbResult: short packet happens!\n"));\r
+          DEBUG ((EFI_D_VERBOSE, "XhcCheckUrbResult: short packet happens!\n"));\r
         }\r
 \r
         TRBType = (UINT8) (TRBPtr->Type);\r
@@ -2111,6 +2115,10 @@ XhcInitializeDeviceSlot (
   // 8) Issue an Address Device Command for the Device Slot, where the command points to the Input\r
   //    Context data structure described above.\r
   //\r
+  // Delay 10ms to meet TRSTRCY delay requirement in usb 2.0 spec chapter 7.1.7.5 before sending SetAddress() request\r
+  // to device.\r
+  //\r
+  gBS->Stall (XHC_RESET_RECOVERY_DELAY);\r
   ZeroMem (&CmdTrbAddr, sizeof (CmdTrbAddr));\r
   PhyAddr = UsbHcGetPciAddrForHostAddr (Xhc->MemPool, Xhc->UsbDevContext[SlotId].InputContext, sizeof (INPUT_CONTEXT));\r
   CmdTrbAddr.PtrLo    = XHC_LOW_32BIT (PhyAddr);\r
@@ -2317,6 +2325,10 @@ XhcInitializeDeviceSlot64 (
   // 8) Issue an Address Device Command for the Device Slot, where the command points to the Input\r
   //    Context data structure described above.\r
   //\r
+  // Delay 10ms to meet TRSTRCY delay requirement in usb 2.0 spec chapter 7.1.7.5 before sending SetAddress() request\r
+  // to device.\r
+  //\r
+  gBS->Stall (XHC_RESET_RECOVERY_DELAY);\r
   ZeroMem (&CmdTrbAddr, sizeof (CmdTrbAddr));\r
   PhyAddr = UsbHcGetPciAddrForHostAddr (Xhc->MemPool, Xhc->UsbDevContext[SlotId].InputContext, sizeof (INPUT_CONTEXT_64));\r
   CmdTrbAddr.PtrLo    = XHC_LOW_32BIT (PhyAddr);\r
@@ -2596,6 +2608,11 @@ XhcInitializeEndpointContext (
       EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
     }\r
 \r
+    if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+      EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+      continue;\r
+    }\r
+\r
     EpAddr    = (UINT8)(EpDesc->EndpointAddress & 0x0F);\r
     Direction = (UINT8)((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r
@@ -2759,6 +2776,11 @@ XhcInitializeEndpointContext64 (
       EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
     }\r
 \r
+    if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+      EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+      continue;\r
+    }\r
+\r
     EpAddr    = (UINT8)(EpDesc->EndpointAddress & 0x0F);\r
     Direction = (UINT8)((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r
@@ -2928,6 +2950,11 @@ XhcSetConfigCmd (
       IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
     }\r
 \r
+    if (IfDesc->Length < sizeof (USB_INTERFACE_DESCRIPTOR)) {\r
+      IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
+      continue;\r
+    }\r
+\r
     Dci = XhcInitializeEndpointContext (Xhc, SlotId, DeviceSpeed, InputContext, IfDesc);\r
     if (Dci > MaxDci) {\r
       MaxDci = Dci;\r
@@ -3013,6 +3040,11 @@ XhcSetConfigCmd64 (
       IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
     }\r
 \r
+    if (IfDesc->Length < sizeof (USB_INTERFACE_DESCRIPTOR)) {\r
+      IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);\r
+      continue;\r
+    }\r
+\r
     Dci = XhcInitializeEndpointContext64 (Xhc, SlotId, DeviceSpeed, InputContext, IfDesc);\r
     if (Dci > MaxDci) {\r
       MaxDci = Dci;\r
@@ -3261,7 +3293,7 @@ XhcSetInterface (
 \r
   IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);\r
   while ((UINTN) IfDesc < ((UINTN) ConfigDesc + ConfigDesc->TotalLength)) {\r
-    if (IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) {\r
+    if ((IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) && (IfDesc->Length >= sizeof (USB_INTERFACE_DESCRIPTOR))) {\r
       if (IfDesc->InterfaceNumber == (UINT8) Request->Index) {\r
         if (IfDesc->AlternateSetting == Xhc->UsbDevContext[SlotId].ActiveAlternateSetting[IfDesc->InterfaceNumber]) {\r
           //\r
@@ -3301,6 +3333,11 @@ XhcSetInterface (
         EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
       }\r
 \r
+      if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+        EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+        continue;\r
+      }\r
+\r
       EpAddr    = (UINT8) (EpDesc->EndpointAddress & 0x0F);\r
       Direction = (UINT8) ((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r
@@ -3458,7 +3495,7 @@ XhcSetInterface64 (
 \r
   IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);\r
   while ((UINTN) IfDesc < ((UINTN) ConfigDesc + ConfigDesc->TotalLength)) {\r
-    if (IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) {\r
+    if ((IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) && (IfDesc->Length >= sizeof (USB_INTERFACE_DESCRIPTOR))) {\r
       if (IfDesc->InterfaceNumber == (UINT8) Request->Index) {\r
         if (IfDesc->AlternateSetting == Xhc->UsbDevContext[SlotId].ActiveAlternateSetting[IfDesc->InterfaceNumber]) {\r
           //\r
@@ -3498,6 +3535,11 @@ XhcSetInterface64 (
         EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
       }\r
 \r
+      if (EpDesc->Length < sizeof (USB_ENDPOINT_DESCRIPTOR)) {\r
+        EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);\r
+        continue;\r
+      }\r
+\r
       EpAddr    = (UINT8) (EpDesc->EndpointAddress & 0x0F);\r
       Direction = (UINT8) ((EpDesc->EndpointAddress & 0x80) ? EfiUsbDataIn : EfiUsbDataOut);\r
 \r