Commit 40a05707 authored by Orjan Friberg's avatar Orjan Friberg Committed by Greg Kroah-Hartman

USB: bluetty.c allocation bug fix

In usb_bluetooth_probe, the transfer buffers for the write pool urbs
are allocated with size 0, because bluetooth->bulk_out_buffer_size isn't set
until after the loop.
parent 26f8beab
...@@ -1151,7 +1151,8 @@ static void * usb_bluetooth_probe(struct usb_device *dev, unsigned int ifnum, ...@@ -1151,7 +1151,8 @@ static void * usb_bluetooth_probe(struct usb_device *dev, unsigned int ifnum,
endpoint = bulk_out_endpoint[0]; endpoint = bulk_out_endpoint[0];
bluetooth->bulk_out_endpointAddress = endpoint->bEndpointAddress; bluetooth->bulk_out_endpointAddress = endpoint->bEndpointAddress;
bluetooth->bulk_out_buffer_size = endpoint->wMaxPacketSize * 2;
/* create our write urb pool */ /* create our write urb pool */
for (i = 0; i < NUM_BULK_URBS; ++i) { for (i = 0; i < NUM_BULK_URBS; ++i) {
struct urb *urb = usb_alloc_urb(0, GFP_KERNEL); struct urb *urb = usb_alloc_urb(0, GFP_KERNEL);
...@@ -1166,8 +1167,6 @@ static void * usb_bluetooth_probe(struct usb_device *dev, unsigned int ifnum, ...@@ -1166,8 +1167,6 @@ static void * usb_bluetooth_probe(struct usb_device *dev, unsigned int ifnum,
} }
bluetooth->write_urb_pool[i] = urb; bluetooth->write_urb_pool[i] = urb;
} }
bluetooth->bulk_out_buffer_size = endpoint->wMaxPacketSize * 2;
endpoint = interrupt_in_endpoint[0]; endpoint = interrupt_in_endpoint[0];
bluetooth->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL); bluetooth->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment