raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

usb: dwc_otg: fix memory corruption in dwc_otg driver

Browse Source 
[Upstream commit 51b1b64917]

The move from the staging tree to the main tree exposed a
longstanding memory corruption bug in the dwc2 driver. The
reordering of the driver initialization caused the dwc2 driver
to corrupt the initialization data of the sdhci driver on the
Raspberry Pi platform, which made the bug show up.

The error is in calling to_usb_device(hsotg->dev), since ->dev
is not a member of struct usb_device. The easiest fix is to
just remove the offending code, since it is not really needed.

Thanks to Stephen Warren for tracking down the cause of this.

Reported-by: Andre Heider <a.heider@gmail.com>
Tested-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
This commit is contained in:
Paul Zimmerman
2014-02-04 11:21:24 -08:00
committed by Phil Elwell
parent a7b4dd27c1
commit 1ad1d52e6c
1 changed files with 0 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
View File

@@ -1003,25 +1003,11 @@ static void endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
{
dwc_irqflags_t flags;
struct usb_device *udev = NULL;
int epnum = usb_endpoint_num(&ep->desc);
int is_out = usb_endpoint_dir_out(&ep->desc);
int is_control = usb_endpoint_xfer_control(&ep->desc);
dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
struct device *dev = DWC_OTG_OS_GETDEV(dwc_otg_hcd->otg_dev->os_dep);
if (dev)
udev = to_usb_device(dev);
else
return;
DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n", epnum);
DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
usb_settoggle(udev, epnum, is_out, 0);
if (is_control)
usb_settoggle(udev, epnum, !is_out, 0);
if (ep->hcpriv) {
dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
}