lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 13 Dec 2010 00:47:24 +0100 (CET) From: Andi Kleen <andi@...stfloor.org> To: andiry.xu@....com, sarah.a.sharp@...ux.intel.com, gregkh@...e.de, ak@...ux.intel.com, linux-kernel@...r.kernel.org, stable@...nel.org Subject: [PATCH] [142/223] xHCI: fix wMaxPacketSize mask 2.6.35-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Andiry Xu <andiry.xu@....com> commit dc07c91b9b4067022210e68d914a6890a4d70622 upstream. USB2.0 spec 9.6.6 says: For all endpoints, bit 10..0 specify the maximum packet size(in bytes). So the wMaxPacketSize mask should be 0x7ff rather than 0x3ff. This patch should be queued for the stable tree. The bug in xhci_endpoint_init() was present as far back as 2.6.31, and the bug in xhci_get_max_esit_payload() was present when the function was introduced in 2.6.34. Reported-by: Sander Eikelenboom <linux@...elenboom.it> Signed-off-by: Andiry Xu <andiry.xu@....com> Signed-off-by: Sarah Sharp <sarah.a.sharp@...ux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de> Signed-off-by: Andi Kleen <ak@...ux.intel.com> --- drivers/usb/host/xhci-mem.c | 4 ++-- drivers/usb/host/xhci.h | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) Index: linux/drivers/usb/host/xhci-mem.c =================================================================== --- linux.orig/drivers/usb/host/xhci-mem.c +++ linux/drivers/usb/host/xhci-mem.c @@ -1086,7 +1086,7 @@ static inline u32 xhci_get_max_esit_payl if (udev->speed == USB_SPEED_SUPER) return ep->ss_ep_comp.wBytesPerInterval; - max_packet = ep->desc.wMaxPacketSize & 0x3ff; + max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize); max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11; /* A 0 in max burst means 1 transfer per ESIT */ return max_packet * (max_burst + 1); @@ -1165,7 +1165,7 @@ int xhci_endpoint_init(struct xhci_hcd * /* Fall through */ case USB_SPEED_FULL: case USB_SPEED_LOW: - max_packet = ep->desc.wMaxPacketSize & 0x3ff; + max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize); ep_ctx->ep_info2 |= MAX_PACKET(max_packet); break; default: Index: linux/drivers/usb/host/xhci.h =================================================================== --- linux.orig/drivers/usb/host/xhci.h +++ linux/drivers/usb/host/xhci.h @@ -614,6 +614,11 @@ struct xhci_ep_ctx { #define MAX_PACKET_MASK (0xffff << 16) #define MAX_PACKET_DECODED(p) (((p) >> 16) & 0xffff) +/* Get max packet size from ep desc. Bit 10..0 specify the max packet size. + * USB2.0 spec 9.6.6. + */ +#define GET_MAX_PACKET(p) ((p) & 0x7ff) + /* tx_info bitmasks */ #define AVG_TRB_LENGTH_FOR_EP(p) ((p) & 0xffff) #define MAX_ESIT_PAYLOAD_FOR_EP(p) (((p) & 0xffff) << 16) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists