net: hso: fix control-request directions

commit 1a6e9a9c68c1f183872e4bcc947382111c2e04eb upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the tiocmset and rfkill requests which erroneously used
usb_rcvctrlpipe().

Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Cc: stable@vger.kernel.org      # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 559c9b6290e1a538c800f5936193a9ef165be99d..5d988829f7d5294ccb5f834e97734d228066b326 100644 (file)
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1710,7 +1710,7 @@ static int hso_serial_tiocmset(struct tty_struct *tty,
        spin_unlock_irqrestore(&serial->serial_lock, flags);
 
        return usb_control_msg(serial->parent->usb,
-                              usb_rcvctrlpipe(serial->parent->usb, 0), 0x22,
+                              usb_sndctrlpipe(serial->parent->usb, 0), 0x22,
                               0x21, val, if_num, NULL, 0,
                               USB_CTRL_SET_TIMEOUT);
 }
@@ -2461,7 +2461,7 @@ static int hso_rfkill_set_block(void *data, bool blocked)
        if (hso_dev->usb_gone)
                rv = 0;
        else
-               rv = usb_control_msg(hso_dev->usb, usb_rcvctrlpipe(hso_dev->usb, 0),
+               rv = usb_control_msg(hso_dev->usb, usb_sndctrlpipe(hso_dev->usb, 0),
                                       enabled ? 0x82 : 0x81, 0x40, 0, 0, NULL, 0,
                                       USB_CTRL_SET_TIMEOUT);
        mutex_unlock(&hso_dev->mutex);