fix NULL pointer with MUSB and DMA on ISO ep

PATCH In review Hunyue Yau 3 participants 3 messages Nov 1, 2007 – Nov 15, 2007

Subsystems (2)

USB MUSB multipoint high speed dual-role controller

lore

Share & tools

lore

Hunyue Yau

author

2007-11-01 22:40 UTC #0 lore raw

PATCH 1/1 fix NULL pointer with MUSB and DMA on ISO ep

Hi,

The MUSB driver fails to pass a proper buffer pointer to musb_write_fifo if DMA is enabled and it is an ISO endpoint. This removes the check that was preventing a proper buffer pointer from being passed.

Tested with a bluetooth headset and USB bluetooth dongle using SCO audio on the 2430SDP.

-- Hunyue
---------------------------------------------------------------------------------
Description:
For the case of an isochonous endpoint, musb_write_fifo may be called with a NULL buffer from musb_host_tx if DMA is enabled. Remove DMA check and always supply a valid buffer as long as the URB contains a valid buffer.

Signed-off-by Hunyue Yau <[email protected]>

drivers/usb/musb/musb_host.c +1 -1

index e488ac7..a7fe072 100644
@@ -1258,7 +1258,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
 			d->actual_length = qh->segsize;
 			if (++qh->iso_idx >= urb->number_of_packets) {
 				done = true;
-			} else if (!dma) {
+			} else {
 				d++;
 				buf = urb->transfer_buffer + d->offset;
 				wLength = d->length;

David Brownell

2007-11-02 16:36 UTC #1 lore raw

Quoted 25 lines · Hunyue Yau

Hi,
The MUSB driver fails to pass a proper buffer pointer to musb_write_fifo if DMA is enabled and it is an ISO endpoint. This removes the check that was preventing a proper buffer pointer from being passed.
Tested with a bluetooth headset and USB bluetooth dongle using SCO audio on the 2430SDP.
-- Hunyue
---------------------------------------------------------------------------------
Description:
For the case of an isochonous endpoint, musb_write_fifo may be called with a NULL buffer from musb_host_tx if DMA is enabled. Remove DMA check and always supply a valid buffer as long as the URB contains a valid buffer.
Signed-off-by Hunyue Yau <[email protected]>
drivers/usb/musb/musb_host.c +0 -0
index e488ac7..a7fe072 100644

drivers/usb/musb/musb_host.c void musb_host_tx(struct musb *musb, u8 epnum) · line 1261

Quoted 5 lines

drivers/usb/musb/musb_host.c +1 -1

@@ -1258,7 +1258,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
 			d->actual_length = qh->segsize;
 			if (++qh->iso_idx >= urb->number_of_packets) {
 				done = true;
-			} else if (!dma) {
+			} else {

... looks right. ACK.

Quoted 9 lines

drivers/usb/musb/musb_host.c +0 -0
 				d++;
 				buf = urb->transfer_buffer + d->offset;
 				wLength = d->length;
_______________________________________________
Linux-omap-open-source mailing list
[email protected]
http://linux.omap.com/mailman/listinfo/linux-omap-open-source

Tony Lindgren

2007-11-15 20:51 UTC #2 lore raw

Quoted 21 lines · David Brownell

Quoted 20 lines · Hunyue Yau
Hi,
The MUSB driver fails to pass a proper buffer pointer to musb_write_fifo if DMA is enabled and it is an ISO endpoint. This removes the check that was preventing a proper buffer pointer from being passed.
Tested with a bluetooth headset and USB bluetooth dongle using SCO audio on the 2430SDP.
-- Hunyue
---------------------------------------------------------------------------------
Description:
For the case of an isochonous endpoint, musb_write_fifo may be called with a NULL buffer from musb_host_tx if DMA is enabled. Remove DMA check and always supply a valid buffer as long as the URB contains a valid buffer.
Signed-off-by Hunyue Yau <[email protected]>

Quoted 17 lines

drivers/usb/musb/musb_host.c void musb_host_tx(struct musb *musb, u8 epnum) · line 1261
Quoted 10 lines
drivers/usb/musb/musb_host.c +1 -1
index e488ac7..a7fe072 100644
@@ -1258,7 +1258,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
 			d->actual_length = qh->segsize;
 			if (++qh->iso_idx >= urb->number_of_packets) {
 				done = true;
-			} else if (!dma) {
+			} else {
... looks right. ACK.
Quoted 4 lines
drivers/usb/musb/musb_host.c +0 -0
 				d++;
 				buf = urb->transfer_buffer + d->offset;
 				wLength = d->length;

Pushing today.

Tony