hrev52826 adds 1 changeset to branch 'master'
old head: 32d4274178e8b4fde9cc1b875ec656008ac58c98
new head: f7e239170263e2ce35e3c73fcc417601f6748b5f
overview:
https://git.haiku-os.org/haiku/log/?qt=range&q=f7e239170263+%5E32d4274178e8
----------------------------------------------------------------------------
f7e239170263: XHCI: Use InitKernelAccess/PrepareKernelAccess properly.
* Actually check return codes of InitKernelAccess().
* WriteDescriptorChain accesses the memory in the IO vectors, so
we need to PrepareKernelAccess before calling it.
Fixes #14752.
[ Augustin Cavalier <waddlesplash@xxxxxxxxx> ]
----------------------------------------------------------------------------
Revision: hrev52826
Commit: f7e239170263e2ce35e3c73fcc417601f6748b5f
URL: https://git.haiku-os.org/haiku/commit/?id=f7e239170263
Author: Augustin Cavalier <waddlesplash@xxxxxxxxx>
Date: Fri Feb 1 03:48:04 2019 UTC
Ticket: https://dev.haiku-os.org/ticket/14752
----------------------------------------------------------------------------
1 file changed, 9 insertions(+), 7 deletions(-)
src/add-ons/kernel/busses/usb/xhci.cpp | 16 +++++++++-------
----------------------------------------------------------------------------
diff --git a/src/add-ons/kernel/busses/usb/xhci.cpp
b/src/add-ons/kernel/busses/usb/xhci.cpp
index 825780ed86..8d690266df 100644
--- a/src/add-ons/kernel/busses/usb/xhci.cpp
+++ b/src/add-ons/kernel/busses/usb/xhci.cpp
@@ -666,10 +666,12 @@ XHCI::SubmitControlRequest(Transfer *transfer)
TRACE_ERROR("Invalid Endpoint");
return B_BAD_VALUE;
}
+ status_t status = transfer->InitKernelAccess();
+ if (status != B_OK)
+ return status;
+
setupDescriptor->transfer = transfer;
- transfer->InitKernelAccess();
_LinkDescriptorForPipe(setupDescriptor, endpoint);
-
TRACE("SubmitControlRequest() request linked\n");
TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016"
B_PRIx64 "\n",
@@ -695,6 +697,10 @@ XHCI::SubmitNormalRequest(Transfer *transfer)
return B_BAD_VALUE;
bool directionIn = (pipe->Direction() == Pipe::In);
+ status_t status = transfer->InitKernelAccess();
+ if (status != B_OK)
+ return status;
+
int32 trbCount = 0;
xhci_td *descriptor = CreateDescriptorChain(transfer->DataLength(),
trbCount);
if (descriptor == NULL)
@@ -740,18 +746,14 @@ XHCI::SubmitNormalRequest(Transfer *transfer)
if (!directionIn) {
TRACE("copying out iov count %ld\n", transfer->VectorCount());
+ transfer->PrepareKernelAccess();
WriteDescriptorChain(descriptor, transfer->Vector(),
transfer->VectorCount());
}
- /* memcpy(descriptor->buffer_log[index],
- (uint8 *)transfer->Vector()[index].iov_base,
transfer->VectorLength());
- }*/
xhci_endpoint *endpoint = (xhci_endpoint *)pipe->ControllerCookie();
descriptor->transfer = transfer;
- transfer->InitKernelAccess();
_LinkDescriptorForPipe(descriptor, endpoint);
-
TRACE("SubmitNormalRequest() request linked\n");
TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016"
B_PRIx64 "\n",
