xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

usb: fix potential isoread overruns, error instead of panic on isoread in ohci

Browse source
This commit is contained in:
cinap_lenrek 2012-09-03 04:23:02 +02:00
parent cfd25faa28
commit 0c52215ae3
3 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
sys/src/9/pc/usbohci.c
View file

@ -1660,7 +1660,7 @@ epread(Ep *ep, void *a, long count)
clrhalt(ep); clrhalt(ep);
return epio(ep, &io[OREAD], a, count, 1); return epio(ep, &io[OREAD], a, count, 1);
case Tiso: case Tiso:
panic("ohci: iso read not implemented"); error("iso read not implemented");
break; break;
default: default:
panic("epread: bad ep ttype %d", ep->ttype); panic("epread: bad ep ttype %d", ep->ttype);

2
sys/src/9/pc/usbuhci.c
View file

@ -1156,6 +1156,8 @@ episoread(Ep *ep, Isoio *iso, void *a, int count)
iunlock(ctlr); /* We could page fault here */ iunlock(ctlr); /* We could page fault here */
memmove(b+tot, tdu->data, nr); memmove(b+tot, tdu->data, nr);
ilock(ctlr); ilock(ctlr);
if(iso->tdu != tdu)
continue;
if(nr < tdu->ndata) if(nr < tdu->ndata)
memmove(tdu->data, tdu->data+nr, tdu->ndata - nr); memmove(tdu->data, tdu->data+nr, tdu->ndata - nr);
tdu->ndata -= nr; tdu->ndata -= nr;

4
sys/src/9/port/usbehci.c
View file

@ -1881,6 +1881,8 @@ episohscpy(Ctlr *ctlr, Ep *ep, Isoio* iso, uchar *b, long count)
iunlock(ctlr); /* We could page fault here */ iunlock(ctlr); /* We could page fault here */
memmove(b+tot, tdu->data, nr); memmove(b+tot, tdu->data, nr);
ilock(ctlr); ilock(ctlr);
if(iso->tdu != tdu)
continue;
if(nr < tdu->ndata) if(nr < tdu->ndata)
memmove(tdu->data, tdu->data+nr, tdu->ndata - nr); memmove(tdu->data, tdu->data+nr, tdu->ndata - nr);
tdu->ndata -= nr; tdu->ndata -= nr;
@ -1917,6 +1919,8 @@ episofscpy(Ctlr *ctlr, Ep *ep, Isoio* iso, uchar *b, long count)
iunlock(ctlr); /* We could page fault here */ iunlock(ctlr); /* We could page fault here */
memmove(b+tot, stdu->data, nr); memmove(b+tot, stdu->data, nr);
ilock(ctlr); ilock(ctlr);
if(iso->stdu != stdu)
continue;
if(nr < stdu->ndata) if(nr < stdu->ndata)
memmove(stdu->data, stdu->data+nr, memmove(stdu->data, stdu->data+nr,
stdu->ndata - nr); stdu->ndata - nr);