USB: EHCI: adjust ehci_iso_stream for changes in ehci_qh

The EHCI driver stores in usb_host_endpoint.hcpriv a pointer to either
an ehci_qh or an ehci_iso_stream structure, and uses the contents of the
hw_info1 field to distinguish the two cases.

After ehci_qh was split into hw and sw parts, ehci_iso_stream must also
be adjusted so that it again looks like an ehci_qh structure.

This fixes a NULL pointer access in ehci_endpoint_disable() when it
tries to access qh->hw->hw_info1.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Reported-by: Colin Fletcher <colin.m.fletcher@googlemail.com>
Cc: stable <stable@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index d8d6d3461d3270de5fb71188c598557b465116f2..dc55a62859c61e0a279757c2155c4dedc2dc3340 100644 (file)
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -995,7 +995,7 @@ rescan:
        /* endpoints can be iso streams.  for now, we don't
         * accelerate iso completions ... so spin a while.
         */
-       if (qh->hw->hw_info1 == 0) {
+       if (qh->hw == NULL) {
                ehci_vdbg (ehci, "iso delay\n");
                goto idle_timeout;
        }

diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index cd1e8bf5327e69653417723a403c29bf4a55b4f0..a0aaaaff256070de68bffcd39d5d4815ee03200b 100644 (file)
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1123,8 +1123,8 @@ iso_stream_find (struct ehci_hcd *ehci, struct urb *urb)
                                        urb->interval);
                }
 
-       /* if dev->ep [epnum] is a QH, info1.maxpacket is nonzero */
-       } else if (unlikely (stream->hw_info1 != 0)) {
+       /* if dev->ep [epnum] is a QH, hw is set */
+       } else if (unlikely (stream->hw != NULL)) {
                ehci_dbg (ehci, "dev %s ep%d%s, not iso??\n",
                        urb->dev->devpath, epnum,
                        usb_pipein(urb->pipe) ? "in" : "out");

diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 2d85e21ff282e9199be521fe630588cf8b3e01fb..b1dce96dd621aa2fbf0d0280fe33f67b47190ce7 100644 (file)
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -394,9 +394,8 @@ struct ehci_iso_sched {
  * acts like a qh would, if EHCI had them for ISO.
  */
 struct ehci_iso_stream {
-       /* first two fields match QH, but info1 == 0 */
-       __hc32                  hw_next;
-       __hc32                  hw_info1;
+       /* first field matches ehci_hq, but is NULL */
+       struct ehci_qh_hw       *hw;
 
        u32                     refcount;
        u8                      bEndpointAddress;