Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S936136AbZLQBtY (ORCPT ); Wed, 16 Dec 2009 20:49:24 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1763554AbZLQBTt (ORCPT ); Wed, 16 Dec 2009 20:19:49 -0500 Received: from kroah.org ([198.145.64.141]:47740 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763538AbZLQBTp (ORCPT ); Wed, 16 Dec 2009 20:19:45 -0500 X-Mailbox-Line: From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 Message-Id: <20091217011558.216332496@mini.kroah.org> User-Agent: quilt/0.48-1 Date: Wed, 16 Dec 2009 17:14:14 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Jay Fenlason , Stefan Richter Subject: [03/90] firewire: ohci: handle receive packets with a data length of zero In-Reply-To: <20091217011835.GA20434@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2169 Lines: 59 2.6.31-stable review patch. If anyone has any objections, please let us know. ------------------ From: Jay Fenlason commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream. Queueing to receive an ISO packet with a payload length of zero silently does nothing in dualbuffer mode, and crashes the kernel in packet-per-buffer mode. Return an error in dualbuffer mode, because the DMA controller won't let us do what we want, and work correctly in packet-per-buffer mode. Signed-off-by: Jay Fenlason Signed-off-by: Stefan Richter Signed-off-by: Greg Kroah-Hartman --- drivers/firewire/ohci.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/drivers/firewire/ohci.c +++ b/drivers/firewire/ohci.c @@ -2180,6 +2180,13 @@ static int ohci_queue_iso_receive_dualbu page = payload >> PAGE_SHIFT; offset = payload & ~PAGE_MASK; rest = p->payload_length; + /* + * The controllers I've tested have not worked correctly when + * second_req_count is zero. Rather than do something we know won't + * work, return an error + */ + if (rest == 0) + return -EINVAL; /* FIXME: make packet-per-buffer/dual-buffer a context option */ while (rest > 0) { @@ -2233,7 +2240,7 @@ static int ohci_queue_iso_receive_packet unsigned long payload) { struct iso_context *ctx = container_of(base, struct iso_context, base); - struct descriptor *d = NULL, *pd = NULL; + struct descriptor *d, *pd; struct fw_iso_packet *p = packet; dma_addr_t d_bus, page_bus; u32 z, header_z, rest; @@ -2271,8 +2278,9 @@ static int ohci_queue_iso_receive_packet d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d))); rest = payload_per_buffer; + pd = d; for (j = 1; j < z; j++) { - pd = d + j; + pd++; pd->control = cpu_to_le16(DESCRIPTOR_STATUS | DESCRIPTOR_INPUT_MORE); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/