USB: EHCI: adjust ehci_iso_stream for changes in ehci_qh (1082f57a) · Commits · 戴 / test

The EHCI driver stores in usb_host_endpoint.hcpriv a pointer to either an ehci_qh or an ehci_iso_stream structure, and uses the contents of the hw_info1 field to distinguish the two cases. After ehci_qh was split into hw and sw parts, ehci_iso_stream must also be adjusted so that it again looks like an ehci_qh structure. This fixes a NULL pointer access in ehci_endpoint_disable() when it tries to access qh->hw->hw_info1. Signed-off-by:

Clemens Ladisch <clemens@ladisch.de> Reported-by:

Colin Fletcher <colin.m.fletcher@googlemail.com> Cc: stable <stable@kernel.org> Acked-by:

Alan Stern <stern@rowland.harvard.edu> Signed-off-by:

Greg Kroah-Hartman <gregkh@suse.de>

drivers/usb/host/ehci-hcd.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -995,7 +995,7 @@ rescan:
		/* endpoints can be iso streams. for now, we don't
		* accelerate iso completions ... so spin a while.
		*/
		if (qh->hw->hw_info1 == 0) {
		if (qh->hw == NULL) {
		ehci_vdbg (ehci, "iso delay\n");
		goto idle_timeout;
		}

drivers/usb/host/ehci-sched.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1123,8 +1123,8 @@ iso_stream_find (struct ehci_hcd ehci, struct urb urb)
		urb->interval);
		}

		/* if dev->ep [epnum] is a QH, info1.maxpacket is nonzero */
		} else if (unlikely (stream->hw_info1 != 0)) {
		/* if dev->ep [epnum] is a QH, hw is set */
		} else if (unlikely (stream->hw != NULL)) {
		ehci_dbg (ehci, "dev %s ep%d%s, not iso??\n",
		urb->dev->devpath, epnum,
		usb_pipein(urb->pipe) ? "in" : "out");

drivers/usb/host/ehci.h

+2 −3

Original line number	Diff line number	Diff line
		@@ -394,9 +394,8 @@ struct ehci_iso_sched {
		* acts like a qh would, if EHCI had them for ISO.
		*/
		struct ehci_iso_stream {
		/* first two fields match QH, but info1 == 0 */
		__hc32 hw_next;
		__hc32 hw_info1;
		/* first field matches ehci_hq, but is NULL */
		struct ehci_qh_hw *hw;

		u32 refcount;
		u8 bEndpointAddress;

Admin message