From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 15 Dec 2009 22:30:40 +0000 (-0800)
Subject: .31 patch
X-Git-Tag: v2.6.27.42~23
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6259d9ce54c44d86afb9fe5f58718adf6422201d;p=thirdparty%2Fkernel%2Fstable-queue.git

.31 patch
---

diff --git a/queue-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch b/queue-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch
new file mode 100644
index 00000000000..2ae69023ad1
--- /dev/null
+++ b/queue-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch
@@ -0,0 +1,59 @@
+From 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 Mon Sep 17 00:00:00 2001
+From: Jay Fenlason <fenlason@redhat.com>
+Date: Fri, 11 Dec 2009 14:23:58 -0500
+Subject: firewire: ohci: handle receive packets with a data length of zero
+
+From: Jay Fenlason <fenlason@redhat.com>
+
+commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream.
+
+Queueing to receive an ISO packet with a payload length of zero
+silently does nothing in dualbuffer mode, and crashes the kernel in
+packet-per-buffer mode.  Return an error in dualbuffer mode, because
+the DMA controller won't let us do what we want, and work correctly in
+packet-per-buffer mode.
+
+Signed-off-by: Jay Fenlason <fenlason@redhat.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2180,6 +2180,13 @@ static int ohci_queue_iso_receive_dualbu
+ 	page     = payload >> PAGE_SHIFT;
+ 	offset   = payload & ~PAGE_MASK;
+ 	rest     = p->payload_length;
++	/*
++	 * The controllers I've tested have not worked correctly when
++	 * second_req_count is zero.  Rather than do something we know won't
++	 * work, return an error
++	 */
++	if (rest == 0)
++		return -EINVAL;
+ 
+ 	/* FIXME: make packet-per-buffer/dual-buffer a context option */
+ 	while (rest > 0) {
+@@ -2233,7 +2240,7 @@ static int ohci_queue_iso_receive_packet
+ 					unsigned long payload)
+ {
+ 	struct iso_context *ctx = container_of(base, struct iso_context, base);
+-	struct descriptor *d = NULL, *pd = NULL;
++	struct descriptor *d, *pd;
+ 	struct fw_iso_packet *p = packet;
+ 	dma_addr_t d_bus, page_bus;
+ 	u32 z, header_z, rest;
+@@ -2271,8 +2278,9 @@ static int ohci_queue_iso_receive_packet
+ 		d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
+ 
+ 		rest = payload_per_buffer;
++		pd = d;
+ 		for (j = 1; j < z; j++) {
+-			pd = d + j;
++			pd++;
+ 			pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
+ 						  DESCRIPTOR_INPUT_MORE);
+ 
diff --git a/queue-2.6.31/series b/queue-2.6.31/series
index f61e409b100..a4c884bf77e 100644
--- a/queue-2.6.31/series
+++ b/queue-2.6.31/series
@@ -1,2 +1,3 @@
 usb-option-add-pid-for-zte.patch
 usb-usb-storage-fix-bug-in-fill_inquiry.patch
+firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch