Hi, Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx> writes: > On 29.12.2016 13:00, Felipe Balbi wrote: >> Stop Endpoint command can come at any point and we >> have no control of that. We should make sure to >> handle COMP_STOP on SETUP phase as well, otherwise >> urb->actual_lenght might be set to negative values >> in some occasions such as below: >> >> urb->length = 4; >> build_control_transfer_td_for(urb, ep); >> >> stop_endpoint(ep); >> >> COMP_STOP: >> [...] >> urb->actual_length = urb->length - trb->length; >> >> trb->length is 8 for SETUP stage (8 control request >> bytes), so actual_length would be set to -4 in this >> case. >> >> While doing that, also make sure to use TRB_TYPE >> field of the actual TRB instead of matching pointers >> to figure out in which stage of the control transfer >> we got our completion event. >> >> Signed-off-by: Felipe Balbi <felipe.balbi@xxxxxxxxxxxxxxx> >> >> --- > > Cherry-picked this one for usb-linus and stable cool, let me know if you want me to rebase the others on top of anything else. They're all sitting on top of v4.10-rc1 for now. -- balbi -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
