From f7e239170263e2ce35e3c73fcc417601f6748b5f Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Thu, 31 Jan 2019 22:48:04 -0500 Subject: [PATCH] XHCI: Use InitKernelAccess/PrepareKernelAccess properly. * Actually check return codes of InitKernelAccess(). * WriteDescriptorChain accesses the memory in the IO vectors, so we need to PrepareKernelAccess before calling it. Fixes #14752. --- src/add-ons/kernel/busses/usb/xhci.cpp | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/src/add-ons/kernel/busses/usb/xhci.cpp b/src/add-ons/kernel/busses/usb/xhci.cpp index 825780ed86..8d690266df 100644 --- a/src/add-ons/kernel/busses/usb/xhci.cpp +++ b/src/add-ons/kernel/busses/usb/xhci.cpp @@ -666,10 +666,12 @@ XHCI::SubmitControlRequest(Transfer *transfer) TRACE_ERROR("Invalid Endpoint"); return B_BAD_VALUE; } - setupDescriptor->transfer = transfer; - transfer->InitKernelAccess(); - _LinkDescriptorForPipe(setupDescriptor, endpoint); + status_t status = transfer->InitKernelAccess(); + if (status != B_OK) + return status; + setupDescriptor->transfer = transfer; + _LinkDescriptorForPipe(setupDescriptor, endpoint); TRACE("SubmitControlRequest() request linked\n"); TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016" B_PRIx64 "\n", @@ -695,6 +697,10 @@ XHCI::SubmitNormalRequest(Transfer *transfer) return B_BAD_VALUE; bool directionIn = (pipe->Direction() == Pipe::In); + status_t status = transfer->InitKernelAccess(); + if (status != B_OK) + return status; + int32 trbCount = 0; xhci_td *descriptor = CreateDescriptorChain(transfer->DataLength(), trbCount); if (descriptor == NULL) @@ -740,18 +746,14 @@ XHCI::SubmitNormalRequest(Transfer *transfer) if (!directionIn) { TRACE("copying out iov count %ld\n", transfer->VectorCount()); + transfer->PrepareKernelAccess(); WriteDescriptorChain(descriptor, transfer->Vector(), transfer->VectorCount()); } - /* memcpy(descriptor->buffer_log[index], - (uint8 *)transfer->Vector()[index].iov_base, transfer->VectorLength()); - }*/ xhci_endpoint *endpoint = (xhci_endpoint *)pipe->ControllerCookie(); descriptor->transfer = transfer; - transfer->InitKernelAccess(); _LinkDescriptorForPipe(descriptor, endpoint); - TRACE("SubmitNormalRequest() request linked\n"); TRACE("Endpoint status 0x%08" B_PRIx32 " 0x%08" B_PRIx32 " 0x%016" B_PRIx64 "\n",