diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2012-09-03 04:23:02 +0200 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2012-09-03 04:23:02 +0200 |
| commit | 0c52215ae32c86751942c3c8c3f784f4a1514731 (patch) | |
| tree | 4995bc0f9a1c7201b4c770f82bafdaa1f7fc2c45 | |
| parent | cfd25faa2857ee9de75910d81530be62d7ba4704 (diff) | |
| download | plan9front-0c52215ae32c86751942c3c8c3f784f4a1514731.tar.xz | |
usb: fix potential isoread overruns, error instead of panic on isoread in ohci
| -rw-r--r-- | sys/src/9/pc/usbohci.c | 2 | ||||
| -rw-r--r-- | sys/src/9/pc/usbuhci.c | 2 | ||||
| -rw-r--r-- | sys/src/9/port/usbehci.c | 4 |
3 files changed, 7 insertions, 1 deletions
diff --git a/sys/src/9/pc/usbohci.c b/sys/src/9/pc/usbohci.c index 154da3062..eee329238 100644 --- a/sys/src/9/pc/usbohci.c +++ b/sys/src/9/pc/usbohci.c @@ -1660,7 +1660,7 @@ epread(Ep *ep, void *a, long count) clrhalt(ep); return epio(ep, &io[OREAD], a, count, 1); case Tiso: - panic("ohci: iso read not implemented"); + error("iso read not implemented"); break; default: panic("epread: bad ep ttype %d", ep->ttype); diff --git a/sys/src/9/pc/usbuhci.c b/sys/src/9/pc/usbuhci.c index 282648ff7..00db8d7bc 100644 --- a/sys/src/9/pc/usbuhci.c +++ b/sys/src/9/pc/usbuhci.c @@ -1156,6 +1156,8 @@ episoread(Ep *ep, Isoio *iso, void *a, int count) iunlock(ctlr); /* We could page fault here */ memmove(b+tot, tdu->data, nr); ilock(ctlr); + if(iso->tdu != tdu) + continue; if(nr < tdu->ndata) memmove(tdu->data, tdu->data+nr, tdu->ndata - nr); tdu->ndata -= nr; diff --git a/sys/src/9/port/usbehci.c b/sys/src/9/port/usbehci.c index 22af2e798..01cf8a3f0 100644 --- a/sys/src/9/port/usbehci.c +++ b/sys/src/9/port/usbehci.c @@ -1881,6 +1881,8 @@ episohscpy(Ctlr *ctlr, Ep *ep, Isoio* iso, uchar *b, long count) iunlock(ctlr); /* We could page fault here */ memmove(b+tot, tdu->data, nr); ilock(ctlr); + if(iso->tdu != tdu) + continue; if(nr < tdu->ndata) memmove(tdu->data, tdu->data+nr, tdu->ndata - nr); tdu->ndata -= nr; @@ -1917,6 +1919,8 @@ episofscpy(Ctlr *ctlr, Ep *ep, Isoio* iso, uchar *b, long count) iunlock(ctlr); /* We could page fault here */ memmove(b+tot, stdu->data, nr); ilock(ctlr); + if(iso->stdu != stdu) + continue; if(nr < stdu->ndata) memmove(stdu->data, stdu->data+nr, stdu->ndata - nr); |