forked from luck/tmp_suning_uos_patched
usb: musb: patches for v3.6 merge window
Just two patches here: First we have a fix to disable DMA in case DMA channel request fails. Second, there's a fix for situations where the user kills musb (by rmmod or any other means) while a transfer is on the fly. In such cases, we could be led into a NULL pointer dereference due to endpoint being disabled and endpoint descriptor being NULL. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAABAgAGBQJP8VRPAAoJEIaOsuA1yqRE4NkP/jVDJ3akrDHtwjh9Ke8xJNNx VrfNyx2QU3cYZ2XnUVdvqzcOeUErZpiE/RPtgDAvccSQl5oOuBL8Zlikcj+JfjHM 8Xt6TSd/coIyPYqq6HB1k/mG/dwwWmMf7U0Be+CFEwHsWhPPp80RnYXuGFx6XjZU wg0mV6iYP1AvGBIN+P5NKwN8HAozz+bxvXDbWyBZUCZL+ws5JTVM53fHy92hFSWs 1N3c3fQizQZP3gmpzuJGV4CUigYWtAcyi1cjGjeIlXroioZK8N55chum+HmrJSiZ kviZ2K0m0Lh3uNiyH7P2g/7skGbTeCURXxUudnlzdIJKVQdrSni5WXBD9Ydzt1sG fv3+NDifMTPOoctJJs6y4QVDSOJBdOkHSpA7RWg2HbzD2EPODtKNn8Z+t3Sx7gaG zL78COmTuhpQOAp0qBcQLuL3dZ2Dq4aDlL9NO2+8vlmrYPilFW0jh/DlUKzryGoA 5a3MA8cBrLG9gwpqlRzyanHjZOU5ejkQaFLQc9wiEzn9fZNh6c/rxk3AedGOzykq Rw8p90jLy2MuSUKgOPihjZbUzRlW71d2Tt8W4lHnzgA24kj/STS8Y+bhlNLfJFHr iRYDdFzJHByyt7/cyUGS9lPCAFfw7hjyflvsRuOkGxLuKRKTQk4F/PWWYN6LmNjt 7+z/2VrbxxzPCbRsxay4 =4uPD -----END PGP SIGNATURE----- Merge tag 'musb-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next usb: musb: patches for v3.6 merge window Just two patches here: First we have a fix to disable DMA in case DMA channel request fails. Second, there's a fix for situations where the user kills musb (by rmmod or any other means) while a transfer is on the fly. In such cases, we could be led into a NULL pointer dereference due to endpoint being disabled and endpoint descriptor being NULL.
This commit is contained in:
commit
979eef3326
@ -328,6 +328,13 @@ static void txstate(struct musb *musb, struct musb_request *req)
|
||||
|
||||
musb_ep = req->ep;
|
||||
|
||||
/* Check if EP is disabled */
|
||||
if (!musb_ep->desc) {
|
||||
dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
|
||||
musb_ep->end_point.name);
|
||||
return;
|
||||
}
|
||||
|
||||
/* we shouldn't get here while DMA is active ... but we do ... */
|
||||
if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
|
||||
dev_dbg(musb->controller, "dma pending...\n");
|
||||
@ -650,6 +657,13 @@ static void rxstate(struct musb *musb, struct musb_request *req)
|
||||
|
||||
len = musb_ep->packet_sz;
|
||||
|
||||
/* Check if EP is disabled */
|
||||
if (!musb_ep->desc) {
|
||||
dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
|
||||
musb_ep->end_point.name);
|
||||
return;
|
||||
}
|
||||
|
||||
/* We shouldn't get here while DMA is active, but we do... */
|
||||
if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
|
||||
dev_dbg(musb->controller, "DMA pending...\n");
|
||||
|
@ -1746,7 +1746,11 @@ void musb_host_rx(struct musb *musb, u8 epnum)
|
||||
c->channel_release(dma);
|
||||
hw_ep->rx_channel = NULL;
|
||||
dma = NULL;
|
||||
/* REVISIT reset CSR */
|
||||
val = musb_readw(epio, MUSB_RXCSR);
|
||||
val &= ~(MUSB_RXCSR_DMAENAB
|
||||
| MUSB_RXCSR_H_AUTOREQ
|
||||
| MUSB_RXCSR_AUTOCLEAR);
|
||||
musb_writew(epio, MUSB_RXCSR, val);
|
||||
}
|
||||
}
|
||||
#endif /* Mentor DMA */
|
||||
|
Loading…
Reference in New Issue
Block a user