From 0c52215ae32c86751942c3c8c3f784f4a1514731 Mon Sep 17 00:00:00 2001 From: cinap_lenrek Date: Mon, 3 Sep 2012 04:23:02 +0200 Subject: [PATCH] usb: fix potential isoread overruns, error instead of panic on isoread in ohci --- sys/src/9/pc/usbohci.c | 2 +- sys/src/9/pc/usbuhci.c | 2 ++ sys/src/9/port/usbehci.c | 4 ++++ 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/sys/src/9/pc/usbohci.c b/sys/src/9/pc/usbohci.c index 154da3062..eee329238 100644 --- a/sys/src/9/pc/usbohci.c +++ b/sys/src/9/pc/usbohci.c @@ -1660,7 +1660,7 @@ epread(Ep *ep, void *a, long count) clrhalt(ep); return epio(ep, &io[OREAD], a, count, 1); case Tiso: - panic("ohci: iso read not implemented"); + error("iso read not implemented"); break; default: panic("epread: bad ep ttype %d", ep->ttype); diff --git a/sys/src/9/pc/usbuhci.c b/sys/src/9/pc/usbuhci.c index 282648ff7..00db8d7bc 100644 --- a/sys/src/9/pc/usbuhci.c +++ b/sys/src/9/pc/usbuhci.c @@ -1156,6 +1156,8 @@ episoread(Ep *ep, Isoio *iso, void *a, int count) iunlock(ctlr); /* We could page fault here */ memmove(b+tot, tdu->data, nr); ilock(ctlr); + if(iso->tdu != tdu) + continue; if(nr < tdu->ndata) memmove(tdu->data, tdu->data+nr, tdu->ndata - nr); tdu->ndata -= nr; diff --git a/sys/src/9/port/usbehci.c b/sys/src/9/port/usbehci.c index 22af2e798..01cf8a3f0 100644 --- a/sys/src/9/port/usbehci.c +++ b/sys/src/9/port/usbehci.c @@ -1881,6 +1881,8 @@ episohscpy(Ctlr *ctlr, Ep *ep, Isoio* iso, uchar *b, long count) iunlock(ctlr); /* We could page fault here */ memmove(b+tot, tdu->data, nr); ilock(ctlr); + if(iso->tdu != tdu) + continue; if(nr < tdu->ndata) memmove(tdu->data, tdu->data+nr, tdu->ndata - nr); tdu->ndata -= nr; @@ -1917,6 +1919,8 @@ episofscpy(Ctlr *ctlr, Ep *ep, Isoio* iso, uchar *b, long count) iunlock(ctlr); /* We could page fault here */ memmove(b+tot, stdu->data, nr); ilock(ctlr); + if(iso->stdu != stdu) + continue; if(nr < stdu->ndata) memmove(stdu->data, stdu->data+nr, stdu->ndata - nr);