Merge pull request #235 from P33M/rpi-3.6.y

popcornmix · popcornmix · commit 770459fbf0a4 · 2013-03-01T07:37:58.000-08:00
dwc_otg: fix potential use-after-free case in interrupt handler
diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_intr.c
@@ -2223,7 +2223,8 @@ int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd, uint32_t num)
 		retval |= handle_hc_nak_intr(dwc_otg_hcd, hc, hc_regs, qtd);
 	}
 	if (hcint.b.ack) {
-		retval |= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);
+		if(!hcint.b.chhltd)
+			retval |= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);
 	}
 	if (hcint.b.nyet) {
 		retval |= handle_hc_nyet_intr(dwc_otg_hcd, hc, hc_regs, qtd);

Original file line number	Diff line number	Diff line change
`@@ -2223,7 +2223,8 @@ int32_t dwc_otg_hcd_handle_hc_n_intr(dwc_otg_hcd_t * dwc_otg_hcd, uint32_t num)`
`2223`	`2223`	`retval \|= handle_hc_nak_intr(dwc_otg_hcd, hc, hc_regs, qtd);`
`2224`	`2224`	`}`
`2225`	`2225`	`if (hcint.b.ack) {`
`2226`		`- retval \|= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);`
	`2226`	`+ if(!hcint.b.chhltd)`
	`2227`	`+ retval \|= handle_hc_ack_intr(dwc_otg_hcd, hc, hc_regs, qtd);`
`2227`	`2228`	`}`
`2228`	`2229`	`if (hcint.b.nyet) {`
`2229`	`2230`	`retval \|= handle_hc_nyet_intr(dwc_otg_hcd, hc, hc_regs, qtd);`