netdev - RE: PROBLEM: usbnet / ax88179_178a: Panic in usb_hcd_map_urb_for

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 13 Jan 2014 11:08:06 +0000
From:	David Laight <David.Laight@...LAB.COM>
To:	'Bjørn Mork' <bjorn@...k.no>,
	Thomas Kear <thomas@...r.co.nz>
CC:	Ben Hutchings <bhutchings@...arflare.com>,
	netdev <netdev@...r.kernel.org>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>
Subject: RE: PROBLEM: usbnet / ax88179_178a: Panic in usb_hcd_map_urb_for_dma

From: Bjørn Mork
> Thomas Kear <thomas@...r.co.nz> writes:
> 
> > On Sat, Jan 11, 2014 at 11:09 AM, Bjrn Mork <bjorn@...k.no> wrote:
> >> But looking at the code I think I found and obvious miss in the SG list
> >> initialisation.  I'll post a proposed fix for that.  Would be good if
> >> someone was able to test it.
> >
> > I've built 3.13.0-rc7-next-20140110 with your patch applied.
> > Unfortunately since this bug has taken anywhere from minutes to days
> > to manifest previously I'm not sure how quickly I'll be able to report
> > on its efficacy.
> 
> Thanks for testing it.
> 
> If I'm correct, then your problem is caused by usbnet incrementing
> urb->num_sgs above the value sg_init_table was called with. This happens
> if usbnet adds padding to a fragmented skb.  Unfortunately I have no
> idea how you can create fragmented skbs with a certain length.  But I'm
> sure others here know?

I've managed to send fragmented skb, but not of specific lengths.
Maybe Nagle can be used on a TCP to get the required merging.
Send an initial fragment to 'prime' Nagle, then send a few fragments
that get sent together when the timer expires (or send data the other
way to force the send).

The patch you submitted is wrong.
Whoever wrote the sg interface was on crack.
The 'last' marker needs moving as well.

	David