cdc-acm problems

[Colin Leroy <colin@colino.net>]

[-- Attachment #1: Type: text/plain, Size: 1183 bytes --]

Hi,

I have problems with cdc-acm killing ohci. I tried to narrow down the problem, 
but didn't get far. 
Basically `killall -HUP pppd` gives (in dmesg):

drivers/usb/class/cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
ohci_hcd 0001:01:1b.1: OHCI Unrecoverable Error, disabled
ohci_hcd 0001:01:1b.1: HC died; cleaning up
usb 4-1: USB disconnect, address 2
bus usb: remove device 4-1:1.0
bus usb: remove device 4-1:1.1
bus usb: remove device 4-1

I modified cdc-acm.c according to the attached patch, and noticed there may be
a buffer overflow: after applying this patch, `dmesg|grep high` gives:
drivers/usb/class/cdc-acm.c: databits index too high: 48
drivers/usb/class/cdc-acm.c: databits index too high: 48
drivers/usb/class/cdc-acm.c: databits index too high: 48
drivers/usb/class/cdc-acm.c: databits index too high: 48
drivers/usb/class/cdc-acm.c: databits index too high: 48

I'm on a Mac (big-endian). Maybe an endianness issue ?
My patch doesn't solve any problem, but maybe exposes one.

By the way, what's the difference between cpu_to_le32p() and cpu_to_le32() ? 
I'm wondering because of the newline.speed = cpu_to_le32p(...) line (537).

Thanks,
-- 
Colin

[-- Attachment #2: cdc-acm.patch --]
[-- Type: application/octet-stream, Size: 1238 bytes --]

Index: drivers/usb/class/cdc-acm.c
===================================================================
RCS file: /home/cvsroot/linuxppc/drivers/usb/class/cdc-acm.c,v
retrieving revision 1.1.1.1
diff -u -u -r1.1.1.1 cdc-acm.c
--- drivers/usb/class/cdc-acm.c	8 Jan 2004 11:25:51 -0000	1.1.1.1
+++ drivers/usb/class/cdc-acm.c	13 Jan 2004 11:59:28 -0000
@@ -45,7 +45,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
-#undef DEBUG
+#define DEBUG
 
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -530,7 +530,7 @@
 	struct termios *termios = tty->termios;
 	struct acm_line newline;
 	int newctrl = acm->ctrlout;
-
+	int offset = 0;
 	if (!ACM_READY(acm))
 		return;
 
@@ -539,7 +539,13 @@
 	newline.stopbits = termios->c_cflag & CSTOPB ? 2 : 0;
 	newline.parity = termios->c_cflag & PARENB ?
 		(termios->c_cflag & PARODD ? 1 : 2) + (termios->c_cflag & CMSPAR ? 2 : 0) : 0;
-	newline.databits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4];
+	
+	offset = (termios->c_cflag & CSIZE) >> 4;
+	if (offset >= sizeof(acm_tty_size)) {
+		dbg("databits index too high: %d\n", offset);
+		offset = 3;
+	}
+	newline.databits = acm_tty_size[offset];
 
 	acm->clocal = ((termios->c_cflag & CLOCAL) != 0);