Re: [PATCH 6/8] musb_host: fix premature PIO transfer end

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello. I wrote:

Feeding 32-bit length cast down to 'u16' to min() to calculate the FIFO count
in musb_host_tx() risks sending a short packet prematurely for transfer sizes
over 64 KB. And although data transfer size shouldn't exceed 65535 bytes for
the control endpoint, making musb_h_ep0_continue() more robust WRT URBs with
possibly oversized buffer will not hurt either...

Signed-off-by: Sergei Shtylyov <sshtylyov@xxxxxxxxxxxxx>

[...]

Index: linux-2.6/drivers/usb/musb/musb_host.c
===================================================================
--- linux-2.6.orig/drivers/usb/musb/musb_host.c
+++ linux-2.6/drivers/usb/musb/musb_host.c
@@ -936,8 +936,8 @@ static bool musb_h_ep0_continue(struct m
 	switch (musb->ep0_stage) {
 	case MUSB_EP0_IN:
 		fifo_dest = urb->transfer_buffer + urb->actual_length;
-		fifo_count = min(len, ((u16) (urb->transfer_buffer_length
-					- urb->actual_length)));
+		fifo_count = min_t(size_t, len, urb->transfer_buffer_length -
+				   urb->actual_length);
 		if (fifo_count < len)
 			urb->status = -EOVERFLOW;
@@ -970,9 +970,9 @@ static bool musb_h_ep0_continue(struct m
 		}
 		/* FALLTHROUGH */
 	case MUSB_EP0_OUT:
-		fifo_count = min(qh->maxpacket, ((u16)
-				(urb->transfer_buffer_length
-				- urb->actual_length)));
+		fifo_count = min_t(size_t, qh->maxpacket,
+				   urb->transfer_buffer_length	-

   Oops, tab ISO space before -. Do I need to repost?

WBR, Sergei
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux