* [PATCH 2/3] USB: serial: mct_u232: fix big-endian baud-rate handling
[not found] <20170511094121.21087-1-johan@kernel.org>
@ 2017-05-11 9:41 ` Johan Hovold
2017-05-11 19:49 ` Pete Zaitcev
2017-05-11 9:41 ` [PATCH 3/3] USB: serial: io_ti: fix div-by-zero in set_termios Johan Hovold
1 sibling, 1 reply; 3+ messages in thread
From: Johan Hovold @ 2017-05-11 9:41 UTC (permalink / raw)
To: linux-usb; +Cc: Johan Hovold, stable, Pete Zaitcev
Drop erroneous cpu_to_le32 when setting the baud rate, something which
corrupted the divisor on big-endian hosts.
Found using sparse:
warning: incorrect type in argument 1 (different base types)
expected unsigned int [unsigned] [usertype] val
got restricted __le32 [usertype] <noident>
Fixes: af2ac1a091bc ("USB: serial mct_usb232: move DMA buffers to heap")
Cc: stable <stable@vger.kernel.org> # 2.6.34
Cc: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/serial/mct_u232.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index edbc81f205c2..70f346f1aa86 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct tty_struct *tty,
return -ENOMEM;
divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
- put_unaligned_le32(cpu_to_le32(divisor), buf);
+ put_unaligned_le32(divisor, buf);
rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
MCT_U232_SET_BAUD_RATE_REQUEST,
MCT_U232_SET_REQUEST_TYPE,
--
2.13.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH 3/3] USB: serial: io_ti: fix div-by-zero in set_termios
[not found] <20170511094121.21087-1-johan@kernel.org>
2017-05-11 9:41 ` [PATCH 2/3] USB: serial: mct_u232: fix big-endian baud-rate handling Johan Hovold
@ 2017-05-11 9:41 ` Johan Hovold
1 sibling, 0 replies; 3+ messages in thread
From: Johan Hovold @ 2017-05-11 9:41 UTC (permalink / raw)
To: linux-usb; +Cc: Johan Hovold, stable
Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.
Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org> # 2.6.12
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/serial/io_ti.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 87798e625d6c..6cefb9cb133d 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2336,8 +2336,11 @@ static void change_port_settings(struct tty_struct *tty,
if (!baud) {
/* pick a default, any default... */
baud = 9600;
- } else
+ } else {
+ /* Avoid a zero divisor. */
+ baud = min(baud, 461550);
tty_encode_baud_rate(tty, baud, baud);
+ }
edge_port->baud_rate = baud;
config->wBaudRate = (__u16)((461550L + baud/2) / baud);
--
2.13.0
^ permalink raw reply related [flat|nested] 3+ messages in thread