usb: musb: patches for v3.6 merge window

Just two patches here:
 
 First we have a fix to disable DMA in case DMA channel
 request fails.
 
 Second, there's a fix for situations where the user
 kills musb (by rmmod or any other means) while a
 transfer is on the fly. In such cases, we could be
 led into a NULL pointer dereference due to endpoint
 being disabled and endpoint descriptor being NULL.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1.4.12 (GNU/Linux)
 
 iQIcBAABAgAGBQJP8VRPAAoJEIaOsuA1yqRE4NkP/jVDJ3akrDHtwjh9Ke8xJNNx
 VrfNyx2QU3cYZ2XnUVdvqzcOeUErZpiE/RPtgDAvccSQl5oOuBL8Zlikcj+JfjHM
 8Xt6TSd/coIyPYqq6HB1k/mG/dwwWmMf7U0Be+CFEwHsWhPPp80RnYXuGFx6XjZU
 wg0mV6iYP1AvGBIN+P5NKwN8HAozz+bxvXDbWyBZUCZL+ws5JTVM53fHy92hFSWs
 1N3c3fQizQZP3gmpzuJGV4CUigYWtAcyi1cjGjeIlXroioZK8N55chum+HmrJSiZ
 kviZ2K0m0Lh3uNiyH7P2g/7skGbTeCURXxUudnlzdIJKVQdrSni5WXBD9Ydzt1sG
 fv3+NDifMTPOoctJJs6y4QVDSOJBdOkHSpA7RWg2HbzD2EPODtKNn8Z+t3Sx7gaG
 zL78COmTuhpQOAp0qBcQLuL3dZ2Dq4aDlL9NO2+8vlmrYPilFW0jh/DlUKzryGoA
 5a3MA8cBrLG9gwpqlRzyanHjZOU5ejkQaFLQc9wiEzn9fZNh6c/rxk3AedGOzykq
 Rw8p90jLy2MuSUKgOPihjZbUzRlW71d2Tt8W4lHnzgA24kj/STS8Y+bhlNLfJFHr
 iRYDdFzJHByyt7/cyUGS9lPCAFfw7hjyflvsRuOkGxLuKRKTQk4F/PWWYN6LmNjt
 7+z/2VrbxxzPCbRsxay4
 =4uPD
 -----END PGP SIGNATURE-----

Merge tag 'musb-for-v3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

usb: musb: patches for v3.6 merge window

Just two patches here:

First we have a fix to disable DMA in case DMA channel
request fails.

Second, there's a fix for situations where the user
kills musb (by rmmod or any other means) while a
transfer is on the fly. In such cases, we could be
led into a NULL pointer dereference due to endpoint
being disabled and endpoint descriptor being NULL.
This commit is contained in:
Greg Kroah-Hartman 2012-07-05 15:09:27 -07:00
commit 979eef3326
2 changed files with 19 additions and 1 deletions

View file

@ -328,6 +328,13 @@ static void txstate(struct musb *musb, struct musb_request *req)
musb_ep = req->ep;
/* Check if EP is disabled */
if (!musb_ep->desc) {
dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
musb_ep->end_point.name);
return;
}
/* we shouldn't get here while DMA is active ... but we do ... */
if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
dev_dbg(musb->controller, "dma pending...\n");
@ -650,6 +657,13 @@ static void rxstate(struct musb *musb, struct musb_request *req)
len = musb_ep->packet_sz;
/* Check if EP is disabled */
if (!musb_ep->desc) {
dev_dbg(musb->controller, "ep:%s disabled - ignore request\n",
musb_ep->end_point.name);
return;
}
/* We shouldn't get here while DMA is active, but we do... */
if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
dev_dbg(musb->controller, "DMA pending...\n");

View file

@ -1746,7 +1746,11 @@ void musb_host_rx(struct musb *musb, u8 epnum)
c->channel_release(dma);
hw_ep->rx_channel = NULL;
dma = NULL;
/* REVISIT reset CSR */
val = musb_readw(epio, MUSB_RXCSR);
val &= ~(MUSB_RXCSR_DMAENAB
| MUSB_RXCSR_H_AUTOREQ
| MUSB_RXCSR_AUTOCLEAR);
musb_writew(epio, MUSB_RXCSR, val);
}
}
#endif /* Mentor DMA */