[PATCH] USB: EHCI: fix conflation of buf == 0 with len == 0
When the ehci-hcd driver prepares a control URB, it tests for a zero-length data stage by looking at the transfer_dma value instead of the transfer_buffer_length. (In fact it does this even for non-control URBs, which is an additional aspect of the same bug.) However, under certain circumstances it's possible for transfer_dma to be 0 while transfer_buffer_length is non-zero. This can happen when a freshly allocated page (mapped to address 0 and marked Copy-On-Write, but never written to) is used as the source buffer for an OUT transfer. This patch (as598) fixes the problem. Signed-off-by: NAlan Stern <stern@rowland.harvard.edu> Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net> Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Showing
想要评论请 注册 或 登录