From owner-p4-projects@FreeBSD.ORG  Sun Jan 13 11:54:03 2008
Return-Path: <owner-p4-projects@FreeBSD.ORG>
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 93B8516A420; Sun, 13 Jan 2008 11:54:03 +0000 (UTC)
Delivered-To: perforce@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 5984416A41A
	for <perforce@FreeBSD.org>; Sun, 13 Jan 2008 11:54:03 +0000 (UTC)
	(envelope-from hselasky@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id 596C113C467
	for <perforce@FreeBSD.org>; Sun, 13 Jan 2008 11:54:03 +0000 (UTC)
	(envelope-from hselasky@FreeBSD.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id m0DBs3tg079153
	for <perforce@FreeBSD.org>; Sun, 13 Jan 2008 11:54:03 GMT
	(envelope-from hselasky@FreeBSD.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.14.1/8.14.1/Submit) id m0DBs2DE079136
	for perforce@freebsd.org; Sun, 13 Jan 2008 11:54:02 GMT
	(envelope-from hselasky@FreeBSD.org)
Date: Sun, 13 Jan 2008 11:54:02 GMT
Message-Id: <200801131154.m0DBs2DE079136@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to
	hselasky@FreeBSD.org using -f
From: Hans Petter Selasky <hselasky@FreeBSD.org>
To: Perforce Change Reviews <perforce@FreeBSD.org>
Cc: 
Subject: PERFORCE change 133184 for review
X-BeenThere: p4-projects@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: p4 projects tree changes <p4-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/p4-projects>
List-Post: <mailto:p4-projects@freebsd.org>
List-Help: <mailto:p4-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Jan 2008 11:54:03 -0000

http://perforce.freebsd.org/chv.cgi?CH=133184

Change 133184 by hselasky@hselasky_laptop001 on 2008/01/13 11:53:19

	
	UHCI bugfix. Avoid fixups on isochronous transfers that
	have a length of zero bytes, because "usbd_get_page()"
	might access invalid memory in the case
	the total length of all the isochronous transfer(s) is also
	zero bytes. This is because no memory is loaded into DMA
	if the total transfer length is zero bytes. This also will
	fix an "off by one" issue in some special cases where
	"usbd_get_page()" is involved. Non-isochronous transfers
	are not affected by this change.

Affected files ...

.. //depot/projects/usb/src/sys/dev/usb/uhci.c#58 edit

Differences ...

==== //depot/projects/usb/src/sys/dev/usb/uhci.c#58 (text+ko) ====

@@ -2255,10 +2255,22 @@
 
 		td->len = *plen;
 
+		if (td->len == 0) {
+			/* 
+			 * Do not call "uhci_mem_layout_fixup()" when
+			 * the length is zero!
+			 */
+			td->td_buffer = 0;
+			td->fix_pc = NULL;
+
+		} else {
+
 		/* fill out buffer pointer and do fixup, if any */
 
 		uhci_mem_layout_fixup(&ml, td);
 
+		}
+
 		/* update status */
 		if (nframes == 0) {
 			td->td_status = htole32