Fixed issue with some keyboards giving too much data

resulting in overrun of the input buffer and memory corruption causing an OOPS. We should be checking for the fact that we might get more data than we want. Thanks Naren.
raspberrypi · Jun 26, 2012 · f679f05 · f679f05
1 parent e3a21fc
commit f679f05
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 8 deletions.
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_ddma.c
@@ -886,7 +886,7 @@ uint8_t update_non_isoc_urb_state_ddma(dwc_otg_hcd_t * hcd,
 	if (hc->ep_type == DWC_OTG_EP_TYPE_CONTROL) {
 	    if (qtd->control_phase == DWC_OTG_CONTROL_DATA) {
 		urb->actual_length += n_bytes - remain;
-		if (remain || urb->actual_length == urb->length) {
+		if (remain || urb->actual_length >= urb->length) {
 			/* 
 			 * For Control Data stage do not set urb->status=0 to prevent
 			 * URB callback. Set it when Status phase done. See below.
@@ -905,7 +905,7 @@ uint8_t update_non_isoc_urb_state_ddma(dwc_otg_hcd_t * hcd,
 	else { 
 	    /* BULK and INTR */
 	    urb->actual_length += n_bytes - remain;
-	    if (remain || urb->actual_length == urb->length) {
+	    if (remain || urb->actual_length >= urb->length) {
 		urb->status = 0;
 		*xfer_done = 1;
 	    }

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
@@ -567,7 +567,7 @@ static int update_urb_state_xfer_comp(dwc_hc_t * hc,
 	   (urb->flags & URB_SEND_ZERO_PACKET) && (urb->actual_length == urb->length) &&
 	   !(urb->length % hc->max_packet)) {
 		xfer_done = 0;
-	} else if (short_read || urb->actual_length == urb->length) {
+	} else if (short_read || urb->actual_length >= urb->length) {
 		xfer_done = 1;
 		urb->status = 0;
 	}
@@ -1876,10 +1876,10 @@ static void handle_hc_chhltd_intr_dma(dwc_otg_hcd_t * hcd,
 	} else if (hcint.b.xacterr && !hcd->core_if->dma_desc_enable) {
 		if (out_nak_enh) {
 			if (hcint.b.nyet || hcint.b.nak || hcint.b.ack) {
-				DWC_DEBUG("XactErr with NYET/NAK/ACK\n");
+				DWC_DEBUGPL(DBG_HCD, "XactErr with NYET/NAK/ACK\n");
 				qtd->error_count = 0;
 			} else {
-				DWC_DEBUG("XactErr without NYET/NAK/ACK\n");
+				DWC_DEBUGPL(DBG_HCD, "XactErr without NYET/NAK/ACK\n");
 			}
 		}
 

diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
@@ -190,6 +190,7 @@ static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
 		     uint32_t * port_addr)
 {
    struct urb *urb = (struct urb *)urb_handle;
+   struct usb_bus *bus;
 #if 1 //GRAYG - temporary
    if (NULL == urb_handle)
       DWC_ERROR("**** %s - NULL URB handle\n", __func__);//GRAYG
@@ -206,12 +207,18 @@ static int _hub_info(dwc_otg_hcd_t * hcd, void *urb_handle, uint32_t * hub_addr,
                 *hub_addr = 0; //GRAYG
                 // we probably shouldn't have a transaction translator if
                 // there's no associated hub?
-        } else
-                *hub_addr = urb->dev->tt->hub->devnum;
+        } else {
+		bus = hcd_to_bus(dwc_otg_hcd_to_hcd(hcd));
+		if (urb->dev->tt->hub == bus->root_hub)
+			*hub_addr = 0;
+		else
+			*hub_addr = urb->dev->tt->hub->devnum;
+	}
+	*port_addr = urb->dev->tt->multi ? urb->dev->ttport : 1;
    } else {
         *hub_addr = 0;
+	*port_addr = urb->dev->ttport;
    }
-   *port_addr = urb->dev->ttport;
    return 0;
 }