Skip to contentSkip to conversation

fix NULL pointer with MUSB and DMA on ISO ep

PATCH In review Hunyue Yau 3 participants 3 messages Nov 1, 2007 – Nov 15, 2007

Subsystems (2)
USB MUSB multipoint high speed dual-role controller
lore
Share & tools
lore

Hunyue Yau

author
#0 lore raw

PATCH 1/1 fix NULL pointer with MUSB and DMA on ISO ep

Hi,

The MUSB driver fails to pass a proper buffer pointer to musb_write_fifo if DMA is enabled and it is an ISO endpoint. This removes the check that was preventing a proper buffer pointer from being passed.

Tested with a bluetooth headset and USB bluetooth dongle using SCO audio on the 2430SDP.

-- Hunyue
---------------------------------------------------------------------------------
Description:
For the case of an isochonous endpoint, musb_write_fifo may be called with a NULL buffer from musb_host_tx if DMA is enabled. Remove DMA check and always supply a valid buffer as long as the URB contains a valid buffer.

Signed-off-by Hunyue Yau <[email protected]>
drivers/usb/musb/musb_host.c +1 -1
index e488ac7..a7fe072 100644
@@ -1258,7 +1258,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
 			d->actual_length = qh->segsize;
 			if (++qh->iso_idx >= urb->number_of_packets) {
 				done = true;
-			} else if (!dma) {
+			} else {
 				d++;
 				buf = urb->transfer_buffer + d->offset;
 				wLength = d->length;
#1 lore raw
Quoted 25 lines · Hunyue Yau

Hi,

The MUSB driver fails to pass a proper buffer pointer to musb_write_fifo if DMA is enabled and it is an ISO endpoint. This removes the check that was preventing a proper buffer pointer from being passed.

Tested with a bluetooth headset and USB bluetooth dongle using SCO audio on the 2430SDP.

-- Hunyue
---------------------------------------------------------------------------------
Description:
For the case of an isochonous endpoint, musb_write_fifo may be called with a NULL buffer from musb_host_tx if DMA is enabled. Remove DMA check and always supply a valid buffer as long as the URB contains a valid buffer.

Signed-off-by Hunyue Yau <[email protected]>
drivers/usb/musb/musb_host.c +0 -0
index e488ac7..a7fe072 100644

drivers/usb/musb/musb_host.c void musb_host_tx(struct musb *musb, u8 epnum) · line 1261

Quoted 5 lines
drivers/usb/musb/musb_host.c +1 -1
@@ -1258,7 +1258,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
 			d->actual_length = qh->segsize;
 			if (++qh->iso_idx >= urb->number_of_packets) {
 				done = true;
-			} else if (!dma) {
+			} else {

... looks right. ACK.

Quoted 9 lines
drivers/usb/musb/musb_host.c +0 -0
 				d++;
 				buf = urb->transfer_buffer + d->offset;
 				wLength = d->length;

_______________________________________________
Linux-omap-open-source mailing list
[email protected]
http://linux.omap.com/mailman/listinfo/linux-omap-open-source

#2 lore raw
Quoted 21 lines · David Brownell
Quoted 20 lines · Hunyue Yau

Hi,

The MUSB driver fails to pass a proper buffer pointer to musb_write_fifo if DMA is enabled and it is an ISO endpoint. This removes the check that was preventing a proper buffer pointer from being passed.

Tested with a bluetooth headset and USB bluetooth dongle using SCO audio on the 2430SDP.

-- Hunyue
---------------------------------------------------------------------------------
Description:
For the case of an isochonous endpoint, musb_write_fifo may be called with a NULL buffer from musb_host_tx if DMA is enabled. Remove DMA check and always supply a valid buffer as long as the URB contains a valid buffer.

Signed-off-by Hunyue Yau <[email protected]>
Quoted 17 lines

drivers/usb/musb/musb_host.c void musb_host_tx(struct musb *musb, u8 epnum) · line 1261

Quoted 10 lines
drivers/usb/musb/musb_host.c +1 -1
index e488ac7..a7fe072 100644
@@ -1258,7 +1258,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
 			d->actual_length = qh->segsize;
 			if (++qh->iso_idx >= urb->number_of_packets) {
 				done = true;
-			} else if (!dma) {
+			} else {

... looks right. ACK.

Quoted 4 lines
drivers/usb/musb/musb_host.c +0 -0
 				d++;
 				buf = urb->transfer_buffer + d->offset;
 				wLength = d->length;

Pushing today.

Tony