xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewire: prevent dropping of completed iso packet header data

Browse Source 
The buffer for the header data of completed iso packets has a fixed
size, so it is possible to configure a stream with a big interval
between interrupt packets or with big headers so that this buffer would
overflow.  Previously, ohci.c would drop any data that would not fit,
but this could make unsuspecting applications believe that fewer than
the actual number of packets have completed.

Instead of dropping data, add calls to flush_iso_completion() so that
there are as many events as needed to report all of the data.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
This commit is contained in:
Clemens Ladisch
2012-03-18 19:05:29 +01:00
committed by Stefan Richter
parent 910e76c607
commit 18d627113b
3 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/firewire/core-cdev.c
View File

@@ -51,7 +51,7 @@
/*
* ABI version history is documented in linux/firewire-cdev.h.
*/
#define FW_CDEV_KERNEL_VERSION 4
#define FW_CDEV_KERNEL_VERSION 5
#define FW_CDEV_VERSION_EVENT_REQUEST2 4
#define FW_CDEV_VERSION_ALLOCATE_REGION_END 4

18
drivers/firewire/ohci.c
View File

@@ -2689,7 +2689,7 @@ static void copy_iso_headers(struct iso_context *ctx, const u32 *dma_hdr)
u32 *ctx_hdr;
if (ctx->header_length + ctx->base.header_size > PAGE_SIZE)
return;
flush_iso_completions(ctx);
ctx_hdr = ctx->header + ctx->header_length;
ctx->last_timestamp = (u16)le32_to_cpu((__force __le32)dma_hdr[0]);
@@ -2826,16 +2826,16 @@ static int handle_it_packet(struct context *context,
sync_it_packet_for_cpu(context, d);
if (ctx->header_length + 4 < PAGE_SIZE) {
ctx_hdr = ctx->header + ctx->header_length;
/* Present this value as big-endian to match the receive code */
*ctx_hdr = cpu_to_be32(
((u32)le16_to_cpu(pd->transfer_status) << 16) |
le16_to_cpu(pd->res_count));
ctx->header_length += 4;
}
if (ctx->header_length + 4 > PAGE_SIZE)
flush_iso_completions(ctx);
ctx_hdr = ctx->header + ctx->header_length;
ctx->last_timestamp = le16_to_cpu(last->res_count);
/* Present this value as big-endian to match the receive code */
*ctx_hdr = cpu_to_be32((le16_to_cpu(pd->transfer_status) << 16) |
le16_to_cpu(pd->res_count));
ctx->header_length += 4;
if (last->control & cpu_to_le16(DESCRIPTOR_IRQ_ALWAYS))
flush_iso_completions(ctx);