leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge tag 'linux-can-fixes-for-4.15-20180116' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Browse Source 
Marc Kleine-Budde says:

====================
pull-request: can 2018-01-16

this is a pull reqeust of a single patch for net/master:

This patch by Stephane Grosjean fixes a potential bug in the packet
fragmentation in the peak USB driver.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
2018-01-17 16:09:22 -05:00
parent d91c3e17f7 d8a243af1a
commit 6ab6dd9e7f
1 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/net/can/usb/peak_usb/pcan_usb_fd.c
View File

@@ -184,7 +184,7 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail)
void *cmd_head = pcan_usb_fd_cmd_buffer(dev); void *cmd_head = pcan_usb_fd_cmd_buffer(dev);
int err = 0; int err = 0;
u8 *packet_ptr; u8 *packet_ptr;
int i, n = 1, packet_len; int packet_len;
ptrdiff_t cmd_len; ptrdiff_t cmd_len;
/* usb device unregistered? */ /* usb device unregistered? */
@@ -201,17 +201,13 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail)
} }
packet_ptr = cmd_head; packet_ptr = cmd_head;
packet_len = cmd_len;
/* firmware is not able to re-assemble 512 bytes buffer in full-speed */ /* firmware is not able to re-assemble 512 bytes buffer in full-speed */
if ((dev->udev->speed != USB_SPEED_HIGH) && if (unlikely(dev->udev->speed != USB_SPEED_HIGH))
(cmd_len > PCAN_UFD_LOSPD_PKT_SIZE)) { packet_len = min(packet_len, PCAN_UFD_LOSPD_PKT_SIZE);
packet_len = PCAN_UFD_LOSPD_PKT_SIZE;
n += cmd_len / packet_len;
} else {
packet_len = cmd_len;
}
for (i = 0; i < n; i++) { do {
err = usb_bulk_msg(dev->udev, err = usb_bulk_msg(dev->udev,
usb_sndbulkpipe(dev->udev, usb_sndbulkpipe(dev->udev,
PCAN_USBPRO_EP_CMDOUT), PCAN_USBPRO_EP_CMDOUT),
@@ -224,7 +220,12 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail)
} }
packet_ptr += packet_len; packet_ptr += packet_len;
} cmd_len -= packet_len;
if (cmd_len < PCAN_UFD_LOSPD_PKT_SIZE)
packet_len = cmd_len;
} while (packet_len > 0);
return err; return err;
} }