From d22087d2a8117f44341e8923082fdd3cce05a09f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 22 Mar 2012 11:44:27 -0700 Subject: [PATCH] 3.2-stable patches added patches: usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch usb-dwc3-use-proper-function-for-setting-endpoint-name.patch --- queue-3.2/series | 2 + ...bogus-test-in-dwc3_gadget_start_isoc.patch | 52 +++++++++++++++++++ ...r-function-for-setting-endpoint-name.patch | 43 +++++++++++++++ 3 files changed, 97 insertions(+) create mode 100644 queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch create mode 100644 queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch diff --git a/queue-3.2/series b/queue-3.2/series index 9b172d8c2d7..77777da6fac 100644 --- a/queue-3.2/series +++ b/queue-3.2/series @@ -13,3 +13,5 @@ powerpc-usb-fix-bug-of-kernel-hang-when-initializing-usb.patch staging-r8712u-add-missing-initialization-and-remove-configuration-parameter-config_r8712_ap.patch staging-r8712u-fix-regression-introduced-by-commit-a5ee652.patch staging-r8712u-fix-regression-in-signal-level-after-commit-c6dc001.patch +usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch +usb-dwc3-use-proper-function-for-setting-endpoint-name.patch diff --git a/queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch b/queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch new file mode 100644 index 00000000000..0c9e3b8a076 --- /dev/null +++ b/queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch @@ -0,0 +1,52 @@ +From 9bafa56c7cee5c6fa68de5924220abb220c7e229 Mon Sep 17 00:00:00 2001 +From: Paul Zimmerman +Date: Fri, 17 Feb 2012 14:10:16 -0800 +Subject: usb: dwc3: fix bogus test in dwc3_gadget_start_isoc + +From: Paul Zimmerman + +commit 9bafa56c7cee5c6fa68de5924220abb220c7e229 upstream. + +Zero is a valid value for a microframe number. So remove the bogus +test for non-zero in dwc3_gadget_start_isoc(). + +Signed-off-by: Paul Zimmerman +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1405,7 +1405,7 @@ static void dwc3_endpoint_transfer_compl + static void dwc3_gadget_start_isoc(struct dwc3 *dwc, + struct dwc3_ep *dep, const struct dwc3_event_depevt *event) + { +- u32 uf; ++ u32 uf, mask; + + if (list_empty(&dep->request_list)) { + dev_vdbg(dwc->dev, "ISOC ep %s run out for requests.\n", +@@ -1413,16 +1413,10 @@ static void dwc3_gadget_start_isoc(struc + return; + } + +- if (event->parameters) { +- u32 mask; +- +- mask = ~(dep->interval - 1); +- uf = event->parameters & mask; +- /* 4 micro frames in the future */ +- uf += dep->interval * 4; +- } else { +- uf = 0; +- } ++ mask = ~(dep->interval - 1); ++ uf = event->parameters & mask; ++ /* 4 micro frames in the future */ ++ uf += dep->interval * 4; + + __dwc3_gadget_kick_transfer(dep, uf, 1); + } diff --git a/queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch b/queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch new file mode 100644 index 00000000000..199a22e3585 --- /dev/null +++ b/queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch @@ -0,0 +1,43 @@ +From 27a78d6a283d6782438f72306746afe4bf44c215 Mon Sep 17 00:00:00 2001 +From: Anton Tikhomirov +Date: Thu, 23 Feb 2012 15:38:46 +0900 +Subject: usb: dwc3: use proper function for setting endpoint name + +From: Anton Tikhomirov + +commit 27a78d6a283d6782438f72306746afe4bf44c215 upstream. + +It's wrong to use the size of array as an argument for strncat. +Memory corruption is possible. strlcat is exactly what we need here. + +Signed-off-by: Anton Tikhomirov +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -449,16 +449,16 @@ static int dwc3_gadget_ep_enable(struct + + switch (usb_endpoint_type(desc)) { + case USB_ENDPOINT_XFER_CONTROL: +- strncat(dep->name, "-control", sizeof(dep->name)); ++ strlcat(dep->name, "-control", sizeof(dep->name)); + break; + case USB_ENDPOINT_XFER_ISOC: +- strncat(dep->name, "-isoc", sizeof(dep->name)); ++ strlcat(dep->name, "-isoc", sizeof(dep->name)); + break; + case USB_ENDPOINT_XFER_BULK: +- strncat(dep->name, "-bulk", sizeof(dep->name)); ++ strlcat(dep->name, "-bulk", sizeof(dep->name)); + break; + case USB_ENDPOINT_XFER_INT: +- strncat(dep->name, "-int", sizeof(dep->name)); ++ strlcat(dep->name, "-int", sizeof(dep->name)); + break; + default: + dev_err(dwc->dev, "invalid endpoint transfer type\n"); -- 2.47.3