| Message ID | 20190318081834.4601-3-guido@kiener-muenchen.de (mailing list archive) |
|---|---|
| State | Superseded |
| Commit | 091dacc3cc10979ab0422f0a9f7fcc27eee97e69 |
| Headers | show |
| Series | [v2,1/3] usb: gadget: net2280: Fix overrun of OUT messages | expand |
Zitat von Guido Kiener <guido@kiener-muenchen.de>: > Restore the status of ep->stopped in function net2272_dequeue(). > > When the given request is not found in the endpoint queue > the function returns -EINVAL without restoring the state of > ep->stopped. Thus the endpoint keeps blocked and does not transfer > any data anymore. > > This fix is only compile-tested, since we do not have a > corresponding hardware. An analogous fix was tested in the sibling > driver. See "usb: gadget: net2280: Fix net2280_dequeue()" > > Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> > --- > drivers/usb/gadget/udc/net2272.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/gadget/udc/net2272.c > b/drivers/usb/gadget/udc/net2272.c > index b77f3126580e..c2011cd7df8c 100644 > --- a/drivers/usb/gadget/udc/net2272.c > +++ b/drivers/usb/gadget/udc/net2272.c > @@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep *_ep, struct > usb_request *_req) > break; > } > if (&req->req != _req) { > + ep->stopped = stopped; > spin_unlock_irqrestore(&ep->dev->lock, flags); > return -EINVAL; > } > -- > 2.17.1 Alan, do you want to add an acknowledgement for the sibling driver, too? Guido
On Tue, 19 Mar 2019 guido@kiener-muenchen.de wrote: > Zitat von Guido Kiener <guido@kiener-muenchen.de>: > > > Restore the status of ep->stopped in function net2272_dequeue(). > > > > When the given request is not found in the endpoint queue > > the function returns -EINVAL without restoring the state of > > ep->stopped. Thus the endpoint keeps blocked and does not transfer > > any data anymore. > > > > This fix is only compile-tested, since we do not have a > > corresponding hardware. An analogous fix was tested in the sibling > > driver. See "usb: gadget: net2280: Fix net2280_dequeue()" > > > > Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> > > --- > > drivers/usb/gadget/udc/net2272.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/usb/gadget/udc/net2272.c > > b/drivers/usb/gadget/udc/net2272.c > > index b77f3126580e..c2011cd7df8c 100644 > > --- a/drivers/usb/gadget/udc/net2272.c > > +++ b/drivers/usb/gadget/udc/net2272.c > > @@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep *_ep, struct > > usb_request *_req) > > break; > > } > > if (&req->req != _req) { > > + ep->stopped = stopped; > > spin_unlock_irqrestore(&ep->dev->lock, flags); > > return -EINVAL; > > } > > -- > > 2.17.1 > > Alan, > > do you want to add an acknowledgement for the sibling driver, too? > > Guido Yes, okay. I can't test this patch either, but for what it's worth: Acked-by: Alan Stern <stern@rowland.harvard.edu> Alan Stern
diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c index b77f3126580e..c2011cd7df8c 100644 --- a/drivers/usb/gadget/udc/net2272.c +++ b/drivers/usb/gadget/udc/net2272.c @@ -945,6 +945,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req) break; } if (&req->req != _req) { + ep->stopped = stopped; spin_unlock_irqrestore(&ep->dev->lock, flags); return -EINVAL; }
Restore the status of ep->stopped in function net2272_dequeue(). When the given request is not found in the endpoint queue the function returns -EINVAL without restoring the state of ep->stopped. Thus the endpoint keeps blocked and does not transfer any data anymore. This fix is only compile-tested, since we do not have a corresponding hardware. An analogous fix was tested in the sibling driver. See "usb: gadget: net2280: Fix net2280_dequeue()" Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> --- drivers/usb/gadget/udc/net2272.c | 1 + 1 file changed, 1 insertion(+)