From 7b01c3cc9fd37599f37f4fd4c077d9e6f26816ec Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 15 Dec 2009 14:31:13 -0800 Subject: [PATCH] .32 patch --- ...e-packets-with-a-data-length-of-zero.patch | 59 +++++++++++++++++++ queue-2.6.32/series | 1 + 2 files changed, 60 insertions(+) create mode 100644 queue-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch diff --git a/queue-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch b/queue-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch new file mode 100644 index 00000000000..676845f73ec --- /dev/null +++ b/queue-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch @@ -0,0 +1,59 @@ +From 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 Mon Sep 17 00:00:00 2001 +From: Jay Fenlason +Date: Fri, 11 Dec 2009 14:23:58 -0500 +Subject: firewire: ohci: handle receive packets with a data length of zero + +From: Jay Fenlason + +commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream. + +Queueing to receive an ISO packet with a payload length of zero +silently does nothing in dualbuffer mode, and crashes the kernel in +packet-per-buffer mode. Return an error in dualbuffer mode, because +the DMA controller won't let us do what we want, and work correctly in +packet-per-buffer mode. + +Signed-off-by: Jay Fenlason +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/ohci.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -2209,6 +2209,13 @@ static int ohci_queue_iso_receive_dualbu + page = payload >> PAGE_SHIFT; + offset = payload & ~PAGE_MASK; + rest = p->payload_length; ++ /* ++ * The controllers I've tested have not worked correctly when ++ * second_req_count is zero. Rather than do something we know won't ++ * work, return an error ++ */ ++ if (rest == 0) ++ return -EINVAL; + + /* FIXME: make packet-per-buffer/dual-buffer a context option */ + while (rest > 0) { +@@ -2262,7 +2269,7 @@ static int ohci_queue_iso_receive_packet + unsigned long payload) + { + struct iso_context *ctx = container_of(base, struct iso_context, base); +- struct descriptor *d = NULL, *pd = NULL; ++ struct descriptor *d, *pd; + struct fw_iso_packet *p = packet; + dma_addr_t d_bus, page_bus; + u32 z, header_z, rest; +@@ -2300,8 +2307,9 @@ static int ohci_queue_iso_receive_packet + d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d))); + + rest = payload_per_buffer; ++ pd = d; + for (j = 1; j < z; j++) { +- pd = d + j; ++ pd++; + pd->control = cpu_to_le16(DESCRIPTOR_STATUS | + DESCRIPTOR_INPUT_MORE); + diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 4f399316a49..da7fbfd0c55 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -1,2 +1,3 @@ usb-usb-storage-fix-bug-in-fill_inquiry.patch usb-option-add-pid-for-zte.patch +firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch -- 2.47.3