This is quite dangerous :-) You can't apply a user requested buffer_size to interrupt_buffer !
The API should only apply the buffer size to bulk buffers... Alain -----Message d'origine----- De : Oliver Neukum [mailto:[EMAIL PROTECTED] Envoyé : lundi 30 juillet 2007 12:45 À : linux-usb-devel@lists.sourceforge.net Cc : [EMAIL PROTECTED]; 'Greg KH' Objet : Re: [linux-usb-devel] usb-serial.c question - potential Memory fault Am Montag 30 Juli 2007 schrieb [EMAIL PROTECTED]: > Hi Greg, > > After a new complete reading of my code against usb-serial.c, I finally > found ( I hope ) my problem. > In usb-serial.c, when bulk_in/out buffers are initialized, each buffer size > are the same as the wMaxPacketSize given by the endpoint. > So, in my case, my device have a value of 64 bytes and I send and receive > bulk data that might have 256 bytes length !!! And like pl2303, I just copy > the user data to port->write_urb->transfer_buffer. You have a problem. Does this extension of the API help you? Regards Oliver -- --- a/include/linux/usb/serial.h 2007-07-30 12:19:39.000000000 +0200 +++ b/include/linux/usb/serial.h 2007-07-30 12:19:46.000000000 +0200 @@ -201,6 +201,7 @@ static inline void usb_set_serial_data ( struct usb_serial_driver { const char *description; const struct usb_device_id *id_table; + int buffer_size; char num_interrupt_in; char num_interrupt_out; char num_bulk_in; --- a/drivers/usb/serial/usb-serial.c 2007-07-30 12:20:11.000000000 +0200 +++ b/drivers/usb/serial/usb-serial.c 2007-07-30 12:20:15.000000000 +0200 @@ -866,7 +866,7 @@ int usb_serial_probe(struct usb_interfac dev_err(&interface->dev, "No free urbs available\n"); goto probe_error; } - buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + buffer_size = type->buffer_size ? type->buffer_size : le16_to_cpu(endpoint->wMaxPacketSize); port->bulk_in_size = buffer_size; port->bulk_in_endpointAddress = endpoint->bEndpointAddress; port->bulk_in_buffer = kmalloc (buffer_size, GFP_KERNEL); @@ -890,7 +890,7 @@ int usb_serial_probe(struct usb_interfac dev_err(&interface->dev, "No free urbs available\n"); goto probe_error; } - buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + buffer_size = type->buffer_size ? type->buffer_size : le16_to_cpu(endpoint->wMaxPacketSize); port->bulk_out_size = buffer_size; port->bulk_out_endpointAddress = endpoint->bEndpointAddress; port->bulk_out_buffer = kmalloc (buffer_size, GFP_KERNEL); @@ -915,7 +915,7 @@ int usb_serial_probe(struct usb_interfac dev_err(&interface->dev, "No free urbs available\n"); goto probe_error; } - buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + buffer_size = type->buffer_size ? type->buffer_size : le16_to_cpu(endpoint->wMaxPacketSize); port->interrupt_in_endpointAddress = endpoint->bEndpointAddress; port->interrupt_in_buffer = kmalloc (buffer_size, GFP_KERNEL); if (!port->interrupt_in_buffer) { @@ -942,7 +942,7 @@ int usb_serial_probe(struct usb_interfac dev_err(&interface->dev, "No free urbs available\n"); goto probe_error; } - buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + buffer_size = type->buffer_size ? type->buffer_size : le16_to_cpu(endpoint->wMaxPacketSize); port->interrupt_out_size = buffer_size; port->interrupt_out_endpointAddress = endpoint->bEndpointAddress; port->interrupt_out_buffer = kmalloc (buffer_size, GFP_KERNEL); ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ linux-usb-devel@lists.sourceforge.net To unsubscribe, use the last form field at: https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
