target/linux/brcm2708/patches-4.14/950-0261-usb-dwc_otg-fix-memory-corruption-in-dwc_otg-driver.patch

   1 From 118227d83e51c2b3e719589eb90846747eb06c62 Mon Sep 17 00:00:00 2001
   2 From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
   3 Date: Tue, 4 Feb 2014 11:21:24 -0800
   4 Subject: [PATCH 261/454] usb: dwc_otg: fix memory corruption in dwc_otg driver
   5
   6 [Upstream commit 51b1b6491752ac066ee8d32cc66042fcc955fef6]
   7
   8 The move from the staging tree to the main tree exposed a
   9 longstanding memory corruption bug in the dwc2 driver. The
  10 reordering of the driver initialization caused the dwc2 driver
  11 to corrupt the initialization data of the sdhci driver on the
  12 Raspberry Pi platform, which made the bug show up.
  13
  14 The error is in calling to_usb_device(hsotg->dev), since ->dev
  15 is not a member of struct usb_device. The easiest fix is to
  16 just remove the offending code, since it is not really needed.
  17
  18 Thanks to Stephen Warren for tracking down the cause of this.
  19
  20 Reported-by: Andre Heider <a.heider@gmail.com>
  21 Tested-by: Stephen Warren <swarren@wwwdotorg.org>
  22 Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 [lukas: port from upstream dwc2 to out-of-tree dwc_otg driver]
  25 Signed-off-by: Lukas Wunner <lukas@wunner.de>
  26 ---
  27  drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 14 --------------
  28  1 file changed, 14 deletions(-)
  29
  30 --- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
  31 +++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c
  32 @@ -1012,25 +1012,11 @@ static void endpoint_disable(struct usb_
  33  static void endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
  34  {
  35         dwc_irqflags_t flags;
  36 -       struct usb_device *udev = NULL;
  37 -       int epnum = usb_endpoint_num(&ep->desc);
  38 -       int is_out = usb_endpoint_dir_out(&ep->desc);
  39 -       int is_control = usb_endpoint_xfer_control(&ep->desc);
  40         dwc_otg_hcd_t *dwc_otg_hcd = hcd_to_dwc_otg_hcd(hcd);
  41 -        struct device *dev = DWC_OTG_OS_GETDEV(dwc_otg_hcd->otg_dev->os_dep);
  42 -
  43 -       if (dev)
  44 -               udev = to_usb_device(dev);
  45 -       else
  46 -               return;
  47
  48         DWC_DEBUGPL(DBG_HCD, "DWC OTG HCD EP RESET: Endpoint Num=0x%02d\n", epnum);
  49
  50         DWC_SPINLOCK_IRQSAVE(dwc_otg_hcd->lock, &flags);
  51 -       usb_settoggle(udev, epnum, is_out, 0);
  52 -       if (is_control)
  53 -               usb_settoggle(udev, epnum, !is_out, 0);
  54 -
  55         if (ep->hcpriv) {
  56                 dwc_otg_hcd_endpoint_reset(dwc_otg_hcd, ep->hcpriv);
  57         }