You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
58 lines
2.2 KiB
Diff
58 lines
2.2 KiB
Diff
6 years ago
|
From 118227d83e51c2b3e719589eb90846747eb06c62 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
|
||
|
|
Date: Tue, 4 Feb 2014 11:21:24 -0800
|
||
|
|
Subject: [PATCH 261/454] usb: dwc_otg: fix memory corruption in dwc_otg driver
|
||
|
|
|
||
|
|
[Upstream commit 51b1b6491752ac066ee8d32cc66042fcc955fef6]
|
||
|
|
|
||
|
|
The move from the staging tree to the main tree exposed a
|
||
|
|
longstanding memory corruption bug in the dwc2 driver. The
|
||
|
|
reordering of the driver initialization caused the dwc2 driver
|
||
|
|
to corrupt the initialization data of the sdhci driver on the
|
||
|
|
Raspberry Pi platform, which made the bug show up.
|
||
|
|
|
||
|
|
The error is in calling to_usb_device(hsotg->dev), since ->dev
|
||
|
|
is not a member of struct usb_device. The easiest fix is to
|
||
|
|
just remove the offending code, since it is not really needed.
|
||
|
|
|
||
|
|
Thanks to Stephen Warren for tracking down the cause of this.
|
||
|
|
|
||
|
|
Reported-by: Andre Heider <a.heider@gmail.com>
|
||
|
|
Tested-by: Stephen Warren <swarren@wwwdotorg.org>
|
||
|
|
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
|
||
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
|
[lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
|
||
|
|
Signed-off-by: Lukas Wunner <lukas@wunner.de>
|
||
|
|
---
|
||
|
|
drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 14 --------------
|
||
|
|
1 file changed, 14 deletions(-)
|
||
|
|
|
||
|
|
--- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
|
||
|
|
+++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
|
||
|
|
@@ -1012,25 +1012,11 @@ static void endpoint_disable(struct usb_
|
||
|
|
static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
|
||
|
|
{
|
||
|
|
dwc_irqflags_t flags;
|
||
|
|
- struct usb_device *udev = NULL;
|
||
|
|
- int epnum = usb_endpoint_num(&ep->desc);
|
||
|
|
- int is_out = usb_endpoint_dir_out(&ep->desc);
|
||
|
|
- int is_control = usb_endpoint_xfer_control(&ep->desc);
|
||
|
|
dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
|
||
|
|
- struct device *dev = DWC_OTG_OS_GETDEV(dwc_otg_hcd->otg_dev->os_dep);
|
||
|
|
-
|
||
|
|
- if (dev)
|
||
|
|
- udev = to_usb_device(dev);
|
||
|
|
- else
|
||
|
|
- return;
|
||
|
|
|
||
|
|
DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n", epnum);
|
||
|
|
|
||
|
|
DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
|
||
|
|
- usb_settoggle(udev, epnum, is_out, 0);
|
||
|
|
- if (is_control)
|
||
|
|
- usb_settoggle(udev, epnum, !is_out, 0);
|
||
|
|
-
|
||
|
|
if (ep->hcpriv) {
|
||
|
|
dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
|
||
|
|
}
|