Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54

Authored by Jay Fenlason
Committed by Stefan Richter
1 parent af0940dac3
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

firewire: ohci: handle receive packets with a data length of zero 

Queueing to receive an ISO packet with a payload length of zero
silently does nothing in dualbuffer mode, and crashes the kernel in
packet-per-buffer mode.  Return an error in dualbuffer mode, because
the DMA controller won't let us do what we want, and work correctly in
packet-per-buffer mode.

Signed-off-by: Jay Fenlason <fenlason@redhat.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Cc: stable@kernel.org

Showing 1 changed file with 10 additions and 2 deletions Side-by-side Diff

drivers/firewire/ohci.c
Diff comments   View file @ 8c0c0cc
... ... @@ -2189,6 +2189,13 @@
2189 2189 page = payload >> PAGE_SHIFT;
2190 2190 offset = payload & ~PAGE_MASK;
2191 2191 rest = p->payload_length;
  2192 + /*
  2193 + * The controllers I've tested have not worked correctly when
  2194 + * second_req_count is zero. Rather than do something we know won't
  2195 + * work, return an error
  2196 + */
  2197 + if (rest == 0)
  2198 + return -EINVAL;
2192 2199  
2193 2200 /* FIXME: make packet-per-buffer/dual-buffer a context option */
2194 2201 while (rest > 0) {
... ... @@ -2242,7 +2249,7 @@
2242 2249 unsigned long payload)
2243 2250 {
2244 2251 struct iso_context *ctx = container_of(base, struct iso_context, base);
2245   - struct descriptor *d = NULL, *pd = NULL;
  2252 + struct descriptor *d, *pd;
2246 2253 struct fw_iso_packet *p = packet;
2247 2254 dma_addr_t d_bus, page_bus;
2248 2255 u32 z, header_z, rest;
2249 2256  
... ... @@ -2280,8 +2287,9 @@
2280 2287 d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
2281 2288  
2282 2289 rest = payload_per_buffer;
  2290 + pd = d;
2283 2291 for (j = 1; j < z; j++) {
2284   - pd = d + j;
  2292 + pd++;
2285 2293 pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
2286 2294 DESCRIPTOR_INPUT_MORE);
2287 2295