Alan Stern 6912354a89 [PATCH] USB: EHCI: fix conflation of buf == 0 with len == 0
When the ehci-hcd driver prepares a control URB, it tests for a
zero-length data stage by looking at the transfer_dma value instead of
the transfer_buffer_length.  (In fact it does this even for non-control
URBs, which is an additional aspect of the same bug.)

However, under certain circumstances it's possible for transfer_dma to
be 0 while transfer_buffer_length is non-zero.  This can happen when a
freshly allocated page (mapped to address 0 and marked Copy-On-Write,
but never written to) is used as the source buffer for an OUT transfer.
This patch (as598) fixes the problem.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2006-01-04 13:48:29 -08:00
..
2005-11-23 23:04:28 -08:00
2005-10-28 08:16:49 -07:00
2005-11-29 21:39:23 -08:00
2005-10-28 16:47:39 -07:00
2005-04-16 15:20:36 -07:00
2006-01-04 13:48:29 -08:00
2005-10-28 16:47:38 -07:00
2005-10-28 16:47:40 -07:00
2005-10-28 16:47:40 -07:00
2005-10-28 16:47:40 -07:00
2005-04-16 15:20:36 -07:00