From: Konstantin Filatov <kfilatov@xxxxxxxxxxxxx>
Commit 689d6eac introduced an implementation of scatter-gather list
for UHCI. This implementation has a bug in case when a non-last sg
element was not aligned by TD's max-pkt-size. This bug was latent
till commit 2851784f which initializes sg_table and enables using
the implementation.
The bug can be easily reproduced with Gadget Zero in full_speed mode
connected to a host with UHCI controller by the standard test from
tools/usb/ with command line
testusb -a -t 7 -c 2000 -s 4096 -v 41
The test crashes with SIGBUS.
This patch shortens TD's packet not only for the last TD in sg list,
but also for the last TD in sg element.
Signed-off-by: Konstantin Filatov <kfilatov@xxxxxxxxxxxxx>
Signed-off-by: Denis V. Lunev <den@xxxxxxxxxx>
CC: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
CC: linux-usb@xxxxxxxxxxxxxxx
---
drivers/usb/host/uhci-q.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 6e6ea21..e0ebc80 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -977,6 +977,9 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
for (;;) { /* Allow zero length packets */
int pktsze = maxsze;
+ if (this_sg_len < pktsze) /* The short packet */
+ pktsze = this_sg_len;
+
if (len <= pktsze) { /* The last packet */
pktsze = len;
if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
--
1.8.1.5
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
