USB: OHCI: fix logic for scheduling isochronous URBs

The isochronous scheduling logic in ohci-hcd has a bug.  The
calculation for skipping TDs that are too late should be carried out
only in the !URB_ISO_ASAP case.  When URB_ISO_ASAP is set, the URB is
pushed back so that none of the TDs are too late, which would cause
the calculation to overflow.

The patch also fixes the calculation to avoid overflow in the case
where the frame value wraps around.

This should be applied to -stable kernels going back to 3.8.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 18 insertions, 14 deletions

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index df1af0bcfe99..fc627fd54116 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -240,7 +240,7 @@ static int ohci_urb_enqueue (
                 if (unlikely(tick_before(frame, next))) {
 
                         /* USB_ISO_ASAP: Round up to the first available slot */
-                        if (urb->transfer_flags & URB_ISO_ASAP)
+                        if (urb->transfer_flags & URB_ISO_ASAP) {
                                 frame += (next - frame + ed->interval - 1) &
                                                 -ed->interval;
 
@@ -248,21 +248,25 @@ static int ohci_urb_enqueue (
                          * Not ASAP: Use the next slot in the stream.  If
                          * the entire URB falls before the threshold, fail.
                          */
-                        else if (tick_before(frame + ed->interval *
+                        } else {
+                                if (tick_before(frame + ed->interval *
                                         (urb->number_of_packets - 1), next)) {
-                                retval = -EXDEV;
-                                usb_hcd_unlink_urb_from_ep(hcd, urb);
-                                goto fail;
-                        }
+                                        retval = -EXDEV;
+                                        usb_hcd_unlink_urb_from_ep(hcd, urb);
+                                        goto fail;
+                                }
 
-                        /*
-                         * Some OHCI hardware doesn't handle late TDs
-                         * correctly.  After retiring them it proceeds to
-                         * the next ED instead of the next TD.  Therefore
-                         * we have to omit the late TDs entirely.
-                         */
-                        urb_priv->td_cnt = DIV_ROUND_UP(next - frame,
-                                        ed->interval);
+                                /*
+                                 * Some OHCI hardware doesn't handle late TDs
+                                 * correctly.  After retiring them it proceeds
+                                 * to the next ED instead of the next TD.
+                                 * Therefore we have to omit the late TDs
+                                 * entirely.
+                                 */
+                                urb_priv->td_cnt = DIV_ROUND_UP(
+                                                (u16) (next - frame),
+                                                ed->interval);
+                        }
                 }
                 urb->start_frame = frame;
         }