linux-kernel - [PATCH ?] usb/gadget/pxa27x_udc: test ep0state == IN_DATA_STAGE rather than non-bool USB_DIR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 14 May 2008 12:29:41 +0200
From:	Roel Kluin <roel.kluin@...il.com>
To:	rjarzmik@...e.fr, dbrownell@...rs.sourceforge.net
CC:	linux-usb@...r.kernel.org, lkml <linux-kernel@...r.kernel.org>
Subject: [PATCH ?] usb/gadget/pxa27x_udc: test ep0state == IN_DATA_STAGE rather
 than non-bool USB_DIR_IN

The patch below was not tested!
#------------------------------------------------------------------------------#
drivers/usb/gadget/pxa27x_udc.c uses USB_DIR_IN as if boolean in functions
inc_ep_stats_{reqs,bytes}, lines 763, 795, 933, 985, 1037 and 1074, but
USB_DIR_IN is defined 0x80.

handle_ep0_ctrl_req() tests USB_DIR_IN bitwise and pxa_udc's ep0_state is set
IN_DATA_STAGE or OUT_DATA_STAGE. so ep->dev->ep0state == IN_DATA_STAGE should be
tested rather than USB_DIR_IN

I am uncertain whether this fix is correct and sufficient, feedback appreciated.
- Maybe more tests are required: is ep->dev == NULL or similar
- Maybe I should test ep->dev->ep0state == OUT_DATA_STAGE rather than 
  ep->dev->ep0state != IN_DATA_STAGE (instead of !USB_DIR_IN)

---
USB_DIR_IN is not boolean, test ep0state == IN_DATA_STAGE instead.

Signed-off-by: Roel Kluin <roel.kluin@...il.com>
---
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
index 75eba20..ea18995 100644
--- a/drivers/usb/gadget/pxa27x_udc.c
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -760,7 +760,7 @@ static void req_done(struct pxa_ep *ep, struct pxa27x_request *req, int status)
  */
 static void ep_end_out_req(struct pxa_ep *ep, struct pxa27x_request *req)
 {
-	inc_ep_stats_reqs(ep, !USB_DIR_IN);
+	inc_ep_stats_reqs(ep, ep->dev->ep0state != IN_DATA_STAGE);
 	req_done(ep, req, 0);
 }
 
@@ -792,7 +792,7 @@ static void ep0_end_out_req(struct pxa_ep *ep, struct pxa27x_request *req)
  */
 static void ep_end_in_req(struct pxa_ep *ep, struct pxa27x_request *req)
 {
-	inc_ep_stats_reqs(ep, USB_DIR_IN);
+	inc_ep_stats_reqs(ep, ep->dev->ep0state == IN_DATA_STAGE);
 	req_done(ep, req, 0);
 }
 
@@ -930,7 +930,8 @@ static int read_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
 
 	while (epout_has_pkt(ep)) {
 		count = read_packet(ep, req);
-		inc_ep_stats_bytes(ep, count, !USB_DIR_IN);
+		inc_ep_stats_bytes(ep, count,
+				ep->dev->ep0state != IN_DATA_STAGE);
 
 		is_short = (count < ep->fifo_size);
 		ep_dbg(ep, "read udccsr:%03x, count:%d bytes%s req %p %d/%d\n",
@@ -982,7 +983,8 @@ static int write_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
 		}
 
 		count = write_packet(ep, req, max);
-		inc_ep_stats_bytes(ep, count, USB_DIR_IN);
+		inc_ep_stats_bytes(ep, count,
+				ep->dev->ep0state == IN_DATA_STAGE);
 		totcount += count;
 
 		/* last packet is usually short (or a zlp) */
@@ -1034,7 +1036,8 @@ static int read_ep0_fifo(struct pxa_ep *ep, struct pxa27x_request *req)
 	while (epout_has_pkt(ep)) {
 		count = read_packet(ep, req);
 		udc_ep_writel(ep, UDCCSR, UDCCSR0_OPC);
-		inc_ep_stats_bytes(ep, count, !USB_DIR_IN);
+		inc_ep_stats_bytes(ep, count,
+				ep->dev->ep0state != IN_DATA_STAGE);
 
 		is_short = (count < ep->fifo_size);
 		ep_dbg(ep, "read udccsr:%03x, count:%d bytes%s req %p %d/%d\n",
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/