Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1082f57a authored by Clemens Ladisch's avatar Clemens Ladisch Committed by Greg Kroah-Hartman
Browse files

USB: EHCI: adjust ehci_iso_stream for changes in ehci_qh 



The EHCI driver stores in usb_host_endpoint.hcpriv a pointer to either
an ehci_qh or an ehci_iso_stream structure, and uses the contents of the
hw_info1 field to distinguish the two cases.

After ehci_qh was split into hw and sw parts, ehci_iso_stream must also
be adjusted so that it again looks like an ehci_qh structure.

This fixes a NULL pointer access in ehci_endpoint_disable() when it
tries to access qh->hw->hw_info1.

Signed-off-by: default avatarClemens Ladisch <clemens@ladisch.de>
Reported-by: default avatarColin Fletcher <colin.m.fletcher@googlemail.com>
Cc: stable <stable@kernel.org>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 92bc3648

drivers/usb/host/ehci-hcd.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -995,7 +995,7 @@ ehci_endpoint_disable (struct usb_hcd *hcd, struct usb_host_endpoint *ep) 
	/* endpoints can be iso streams.  for now, we don't

	/* endpoints can be iso streams.  for now, we don't

	 * accelerate iso completions ... so spin a while.

	 * accelerate iso completions ... so spin a while.

	 */

	 */

	if (qh->hw->hw_info1 == 0) {

	if (qh->hw == NULL) {

		ehci_vdbg (ehci, "iso delay\n");

		ehci_vdbg (ehci, "iso delay\n");

		goto idle_timeout;

		goto idle_timeout;

	}

	}

drivers/usb/host/ehci-sched.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -1123,8 +1123,8 @@ iso_stream_find (struct ehci_hcd *ehci, struct urb *urb) 
					urb->interval);

					urb->interval);

		}

		}





	/* if dev->ep [epnum] is a QH, info1.maxpacket is nonzero */

	/* if dev->ep [epnum] is a QH, hw is set */

	} else if (unlikely (stream->hw_info1 != 0)) {

	} else if (unlikely (stream->hw != NULL)) {

		ehci_dbg (ehci, "dev %s ep%d%s, not iso??\n",

		ehci_dbg (ehci, "dev %s ep%d%s, not iso??\n",

			urb->dev->devpath, epnum,

			urb->dev->devpath, epnum,

			usb_pipein(urb->pipe) ? "in" : "out");

			usb_pipein(urb->pipe) ? "in" : "out");

drivers/usb/host/ehci.h

+2 −3
Original line number Original line Diff line number Diff line
@@ -394,9 +394,8 @@ struct ehci_iso_sched { 
 * acts like a qh would, if EHCI had them for ISO.

 * acts like a qh would, if EHCI had them for ISO.

 */

 */

struct ehci_iso_stream {

struct ehci_iso_stream {

	/* first two fields match QH, but info1 == 0 */

	/* first field matches ehci_hq, but is NULL */

	__hc32			hw_next;

	struct ehci_qh_hw	*hw;

	__hc32			hw_info1;





	u32			refcount;

	u32			refcount;

	u8			bEndpointAddress;

	u8			bEndpointAddress;