netdev - Re: [PATCH net] net: cdc_ncm: workaround for missing CDC Union

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 21 Jan 2013 15:47:13 +0100
From:	Bjørn Mork <bjorn@...k.no>
To:	Alexey Orishko <alexey.orishko@...il.com>
Cc:	Oliver Neukum <oliver@...kum.org>, netdev@...r.kernel.org,
	linux-usb@...r.kernel.org, Greg Suarez <gsuarez@...thmicro.com>,
	Alexey Orishko <alexey.orishko@...ricsson.com>
Subject: Re: [PATCH net] net: cdc_ncm: workaround for missing CDC Union

Bjørn Mork <bjorn@...k.no> writes:

> I have another issue with the Sierra firmware which I hope you can help
> me with: The MC7710 device requires at ZLP even if we send
> dwNtbOutMaxSize sized NTBs. This is a problem because the current code
> explicitly prevents this.

If anyone found this more than normally confused, then that is
correct...

What the NCM code does is that it sends a *short* packet whenever the
usbnet would normally have done so, except if the NTP length >=
dwNtbOutMaxSize.

The problem is that we do not set 

	urb->transfer_flags |= URB_ZERO_PACKET;

either in this special case, resulting in neither a short nor a zero
length packet being sent.  I believe this is what the Sierra firmware
chokes at. This seems to fix the issue, and is IMHO correct:

diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 42f51c7..3a5673a 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -366,7 +366,7 @@ err:

 static const struct driver_info cdc_mbim_info = {
        .description = "CDC MBIM",
-       .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+       .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
        .bind = cdc_mbim_bind,
        .unbind = cdc_mbim_unbind,
        .manage_power = cdc_mbim_manage_power,

But I wonder if this isn't really a generic problem in usbnet.  The
FLAG_MULTI_PACKET test here seems completely bogus:

	if (length % dev->maxpacket == 0) {
		if (!(info->flags & FLAG_SEND_ZLP)) {
			if (!(info->flags & FLAG_MULTI_PACKET)) {
				urb->transfer_buffer_length++;
				if (skb_tailroom(skb)) {
					skb->data[skb->len] = 0;
					__skb_put(skb, 1);
				}
			}
		} else
			urb->transfer_flags |= URB_ZERO_PACKET;
	}

Either the FLAG_MULTI_PACKET minidriver will have already padded the
buffer so that we do not hit (length % dev->maxpacket == 0), or we
should choose one of the alternatives: ZLP or padding.

Minidrivers not wanting the short packets (like cdc_ncm) must set
FLAG_SEND_ZLP.

Bjørn
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html