linux-kernel - [PATCH] Regression: Revert "Bluetooth: use buffer priority to mark URB_ISO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 22 Jan 2012 21:58:01 -0800
From:	Keith Packard <keithp@...thp.com>
To:	linux-kernel@...r.kernel.org
Cc:	Keith Packard <keithp@...thp.com>, linux-usb@...r.kernel.org,
	linux-bluetooth@...r.kernel.org
Subject: [PATCH] Regression: Revert "Bluetooth: use buffer priority to mark URB_ISO_ASAP flag"

This reverts commit b8aabfc92249b239c425da7e4ca85b7e4855e984.

URB_ISO_ASAP may only be used with iso end points, but this patch was
attempting to use it with a bulk endpoint. When DEBUG is defined in
the USB stack, it checks for invalid flags and returns -EINVAL instead
of actually transmitting the data.

Signed-off-by: Keith Packard <keithp@...thp.com>
---

Ok, so this is a comedy of errors. The Bluetooth code is trying to use
an iso-specific flag (URB_ISO_ASAP) on a bulk endpoint, which is
invalid, but normally harmless. Unless the USB code is compiled for
debugging, in which case it checks a bunch for incorrect usage and
discards URBs which are wrong.

As far as I'm concerned, #ifdef DEBUG code should never ever change
the behaviour of the code, and so I'd say the USB code is even more
broken than the bluetooth code...

In any case, to reproduce this issue, enable CONFIG_USB_DEBUG and then
try to use bluetooth (sdptool browse). You'll get error messages from
the USB stack:

	usb 1-1.1.3: BOGUS urb flags, 2 --> 0

Apply this patch and bluetooth starts working again.

 drivers/bluetooth/btusb.c |    3 ---
 1 files changed, 0 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f00f596..b7c4f4e 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -726,9 +726,6 @@ static int btusb_send_frame(struct sk_buff *skb)
 		usb_fill_bulk_urb(urb, data->udev, pipe,
 				skb->data, skb->len, btusb_tx_complete, skb);

-		if (skb->priority >= HCI_PRIO_MAX - 1)
-			urb->transfer_flags  = URB_ISO_ASAP;
-
 		hdev->stat.acl_tx++;
 		break;

-- 
1.7.8.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/