From: Xenia Ragiadakou <burzalodowa@xxxxxxxxx> This patch fixes the retrieval of the DMA address of the TRB that generated the event by converting the field[0] (low address bits) and field[1] (high address bits) to CPU byteorder and then typecasting field[1] to u64 so that the bitshift will not lead to overflow. In the original code, the typecasting of le32 to u64 was incorrect and the subsequent conversion to le64 reverts the low and high address parts. This bug was found using sparse. This patch should be backported to kernels as old as 3.12, that contain the commit 63a23b9a7451660525c90b08219e14e701e294f1 "xhci: add xhci_cmd_completion trace event" Signed-off-by: Xenia Ragiadakou <burzalodowa@xxxxxxxxx> Signed-off-by: Sarah Sharp <sarah.a.sharp@xxxxxxxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx --- drivers/usb/host/xhci-trace.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h index 20364cc8d2fb..afe093340834 100644 --- a/drivers/usb/host/xhci-trace.h +++ b/drivers/usb/host/xhci-trace.h @@ -120,8 +120,8 @@ DECLARE_EVENT_CLASS(xhci_log_event, ), TP_fast_assign( __entry->va = trb_va; - __entry->dma = le64_to_cpu(((u64)ev->field[1]) << 32 | - ev->field[0]); + __entry->dma = ((u64)le32_to_cpu(ev->field[1])) << 32 | + le32_to_cpu(ev->field[0]); __entry->status = le32_to_cpu(ev->field[2]); __entry->flags = le32_to_cpu(ev->field[3]); memcpy(__get_dynamic_array(trb), trb_va, -- 1.8.3.3 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
