From 181c29310fe0479fdb501d3e31582999b8258e1a Mon Sep 17 00:00:00 2001
From: Matthew Garrett <mjg@redhat.com>
Date: Tue, 14 Aug 2012 16:44:49 -0400
Subject: [PATCH] --- yaml --- r: 322703 b: refs/heads/master c:
 e955a1cd086de4d165ae0f4c7be7289d84b63bdc h: refs/heads/master i:   322701:
 f5a1ac321bc06400c85465b58bef878be6c381fa   322699:
 4300042f19bd86dcc085a36210445138ec7eadec   322695:
 d1a38e477ecb5081cba2b2340707cb5bd8f21d1e   322687:
 e3fdb54ccc8758912e4801575379707324da7ff8 v: v3

---
 [refs]                              |  2 +-
 trunk/drivers/usb/host/pci-quirks.c | 12 ++++++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 022d46d10397..832a086cb15d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 052c7f9ffb0e95843e75448d02664459253f9ff8
+refs/heads/master: e955a1cd086de4d165ae0f4c7be7289d84b63bdc
diff --git a/trunk/drivers/usb/host/pci-quirks.c b/trunk/drivers/usb/host/pci-quirks.c
index 20b9f45f931c..966d1484ee79 100644
--- a/trunk/drivers/usb/host/pci-quirks.c
+++ b/trunk/drivers/usb/host/pci-quirks.c
@@ -841,12 +841,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
 	void __iomem *op_reg_base;
 	u32 val;
 	int timeout;
+	int len = pci_resource_len(pdev, 0);
 
 	if (!mmio_resource_enabled(pdev, 0))
 		return;
 
-	base = ioremap_nocache(pci_resource_start(pdev, 0),
-				pci_resource_len(pdev, 0));
+	base = ioremap_nocache(pci_resource_start(pdev, 0), len);
 	if (base == NULL)
 		return;
 
@@ -856,9 +856,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
 	 */
 	ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
 	do {
+		if ((ext_cap_offset + sizeof(val)) > len) {
+			/* We're reading garbage from the controller */
+			dev_warn(&pdev->dev,
+				 "xHCI controller failing to respond");
+			return;
+		}
+
 		if (!ext_cap_offset)
 			/* We've reached the end of the extended capabilities */
 			goto hc_init;
+
 		val = readl(base + ext_cap_offset);
 		if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
 			break;