commit 25612f23b5ba1f7d0fb96dbf576b98dc122da24c
author Stefan Brüns <stefan.bruens@rwth-aachen.de> Sat Jan 23 01:42:25 2016 +0100
committer Marek Vasut <marex@denx.de> Sat Jan 23 16:21:11 2016 +0100
tree 5858d0ff3833c4b00f3bf7ca1399aa637cf65278
parent d2ff51b372a6800fcf1394fc2ca9821d86b15335

usb: dwc2: Do not mix data toggle for IN and OUT endpoints, check bounds

USB protocol allows for 16 IN and 16 OUT endpoints (USB 2.0 Spec,
8.3.2.2 Endpoint Field). A function may have an EP 1 for both IN and OUT,
so these two should be kept separate. As EPs are either BULK or INTERRUPT
(or ISO), it is fine to have one array per direction for all transfer
types (also see e236519b7365ef75c5da6a5623f0b03d9c00cfae).

USB device address is 7 bits, so a bus may have more than 16 devices.
Check the device number, as the DWC2 driver only supports BULK/ISO for
the first 16 devices.

Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>

drivers/usb/host/dwc2.c

diff --git a/drivers/usb/host/dwc2.c b/drivers/usb/host/dwc2.c
index 291e4a5..b272c57 100644
--- a/drivers/usb/host/dwc2.c
+++ b/drivers/usb/host/dwc2.c
@@ -34,7 +34,8 @@
 	uint8_t *aligned_buffer;
 	uint8_t *status_buffer;
 #endif
-	int bulk_data_toggle[MAX_DEVICE][MAX_ENDPOINT];
+	u8 in_data_toggle[MAX_DEVICE][MAX_ENDPOINT];
+	u8 out_data_toggle[MAX_DEVICE][MAX_ENDPOINT];
 	struct dwc2_core_regs *regs;
 	int root_hub_devnum;
 };
@@ -739,7 +740,7 @@
 	return stat;
 }
 
-int wait_for_chhltd(struct dwc2_hc_regs *hc_regs, uint32_t *sub, int *toggle)
+int wait_for_chhltd(struct dwc2_hc_regs *hc_regs, uint32_t *sub, u8 *toggle)
 {
 	int ret;
 	uint32_t hcint, hctsiz;
@@ -775,7 +776,7 @@
 };
 
 static int transfer_chunk(struct dwc2_hc_regs *hc_regs, void *aligned_buffer,
-			  int *pid, int in, void *buffer, int num_packets,
+			  u8 *pid, int in, void *buffer, int num_packets,
 			  int xfer_len, int *actual_len, int odd_frame)
 {
 	int ret = 0;
@@ -829,7 +830,7 @@
 }
 
 int chunk_msg(struct dwc2_priv *priv, struct usb_device *dev,
-	      unsigned long pipe, int *pid, int in, void *buffer, int len)
+	      unsigned long pipe, u8 *pid, int in, void *buffer, int len)
 {
 	struct dwc2_core_regs *regs = priv->regs;
 	struct dwc2_hc_regs *hc_regs = &regs->hc_regs[DWC2_HC_CHANNEL];
@@ -960,14 +961,19 @@
 {
 	int devnum = usb_pipedevice(pipe);
 	int ep = usb_pipeendpoint(pipe);
+	u8* pid;
 
-	if (devnum == priv->root_hub_devnum) {
+	if ((devnum >= MAX_DEVICE) || (devnum == priv->root_hub_devnum)) {
 		dev->status = 0;
 		return -EINVAL;
 	}
 
-	return chunk_msg(priv, dev, pipe, &priv->bulk_data_toggle[devnum][ep],
-			 usb_pipein(pipe), buffer, len);
+	if (usb_pipein(pipe))
+		pid = &priv->in_data_toggle[devnum][ep];
+	else
+		pid = &priv->out_data_toggle[devnum][ep];
+
+	return chunk_msg(priv, dev, pipe, pid, usb_pipein(pipe), buffer, len);
 }
 
 static int _submit_control_msg(struct dwc2_priv *priv, struct usb_device *dev,
@@ -975,7 +981,8 @@
 			       struct devrequest *setup)
 {
 	int devnum = usb_pipedevice(pipe);
-	int pid, ret, act_len;
+	int ret, act_len;
+	u8 pid;
 	/* For CONTROL endpoint pid should start with DATA1 */
 	int status_direction;
 
@@ -1075,8 +1082,10 @@
 		     DWC2_HPRT0_PRTRST);
 
 	for (i = 0; i < MAX_DEVICE; i++) {
-		for (j = 0; j < MAX_ENDPOINT; j++)
-			priv->bulk_data_toggle[i][j] = DWC2_HC_PID_DATA0;
+		for (j = 0; j < MAX_ENDPOINT; j++) {
+			priv->in_data_toggle[i][j] = DWC2_HC_PID_DATA0;
+			priv->out_data_toggle[i][j] = DWC2_HC_PID_DATA0;
+		}
 	}
 
 	return 0;