Hello. I wrote:
Feeding 32-bit length cast down to 'u16' to min() to calculate the FIFO count in musb_host_tx() risks sending a short packet prematurely for transfer sizes over 64 KB. And although data transfer size shouldn't exceed 65535 bytes for the control endpoint, making musb_h_ep0_continue() more robust WRT URBs with possibly oversized buffer will not hurt either...
Signed-off-by: Sergei Shtylyov <[email protected]>
[...]
Index: linux-2.6/drivers/usb/musb/musb_host.c =================================================================== --- linux-2.6.orig/drivers/usb/musb/musb_host.c +++ linux-2.6/drivers/usb/musb/musb_host.c @@ -936,8 +936,8 @@ static bool musb_h_ep0_continue(struct m switch (musb->ep0_stage) { case MUSB_EP0_IN: fifo_dest = urb->transfer_buffer + urb->actual_length; - fifo_count = min(len, ((u16) (urb->transfer_buffer_length - - urb->actual_length))); + fifo_count = min_t(size_t, len, urb->transfer_buffer_length - + urb->actual_length); if (fifo_count < len) urb->status = -EOVERFLOW;@@ -970,9 +970,9 @@ static bool musb_h_ep0_continue(struct m} /* FALLTHROUGH */ case MUSB_EP0_OUT: - fifo_count = min(qh->maxpacket, ((u16) - (urb->transfer_buffer_length - - urb->actual_length))); + fifo_count = min_t(size_t, qh->maxpacket, + urb->transfer_buffer_length -
Oops, tab ISO space before -. Do I need to repost? WBR, Sergei _______________________________________________ Davinci-linux-open-source mailing list [email protected] http://linux.davincidsp.com/mailman/listinfo/davinci-linux-open-source
