Make sure we do not allocate urbs if we do not have a bulk endpoint.

Legacy code used incorrect assumption to test for bulk endpoints.

Reported-by: Dan Carpenter <dan.carpen...@oracle.com>
Cc: stable <sta...@vger.kernel.org>
Signed-off-by: Johan Hovold <jhov...@gmail.com>
---

Thanks for catching this Dan. The driver has been using the incorrect
assumption that the unsigned endpoint address would be -1 when there's no bulk
endpoint (in fact its zero).

My memory-leak patch included a direct comparison which Dan's compiler caught.
The test in the fix wasn't supposed to have been there as I decided to keep
the original code in my final version, but at least this way we found the bogus
assumption.

So, Greg, this one applies on top of usb-linus and should go in v3.7. The bad
test (in setup_urb) has been there since the first version of the driver, but
note that this patch only applies on top of the port-data fixes in usb-linus
(marked for stable).

Thanks,
Johan


 drivers/usb/serial/usb_wwan.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 61a73ad..a3e9c09 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -455,9 +455,6 @@ static struct urb *usb_wwan_setup_urb(struct 
usb_serial_port *port,
        struct usb_serial *serial = port->serial;
        struct urb *urb;
 
-       if (endpoint == -1)
-               return NULL;    /* endpoint not needed */
-
        urb = usb_alloc_urb(0, GFP_KERNEL);     /* No ISO */
        if (urb == NULL) {
                dev_dbg(&serial->interface->dev,
@@ -489,6 +486,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        init_usb_anchor(&portdata->delayed);
 
        for (i = 0; i < N_IN_URB; i++) {
+               if (!port->bulk_in_size)
+                       break;
+
                buffer = (u8 *)__get_free_page(GFP_KERNEL);
                if (!buffer)
                        goto bail_out_error;
@@ -502,8 +502,8 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        }
 
        for (i = 0; i < N_OUT_URB; i++) {
-               if (port->bulk_out_endpointAddress == -1)
-                       continue;
+               if (!port->bulk_out_size)
+                       break;
 
                buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
                if (!buffer)
-- 
1.7.12.4

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to