netdev - Re: [PATCH] ath9k_htc: avoid memcpy when downloading firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 03 Mar 2015 22:41:23 +0800
From:	Fred Chou <fred.chou.nd@...il.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
CC:	ath9k-devel@....qualcomm.com, kvalo@...eaurora.org,
	linux-wireless@...r.kernel.org, ath9k-devel@...ts.ath9k.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ath9k_htc: avoid memcpy when downloading firmware



On 3/3/2015 2:00 PM, Eric Dumazet wrote:
> On Tue, 2015-03-03 at 12:24 +0800, Fred Chou wrote:
>> From: Fred Chou <fred.chou.nd@...il.com>
>>
>> The temporary buffer to hold firmware data is not really needed,
>> and memcpy can be avoided by using data pointer instead.
>>
>> Signed-off-by: Fred Chou <fred.chou.nd@...il.com>
>> ---
>>  drivers/net/wireless/ath/ath9k/hif_usb.c | 12 ++----------
>>  1 file changed, 2 insertions(+), 10 deletions(-)
>>
>> diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
>> index 10c02f5..0bc35a8 100644
>> --- a/drivers/net/wireless/ath/ath9k/hif_usb.c
>> +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
>> @@ -986,30 +986,22 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
>>  	const void *data = hif_dev->fw_data;
> 
> Here data can be vmalloc() backed.
> 
>>  	size_t len = hif_dev->fw_size;
>>  	u32 addr = AR9271_FIRMWARE;
>> -	u8 *buf = kzalloc(4096, GFP_KERNEL);
> 
> Here buf is kmalloc() backed.
> 
>>  	u32 firm_offset;
>>  
>> -	if (!buf)
>> -		return -ENOMEM;
>> -
>>  	while (len) {
>>  		transfer = min_t(size_t, len, 4096);
>> -		memcpy(buf, data, transfer);
>>  
>>  		err = usb_control_msg(hif_dev->udev,
>>  				      usb_sndctrlpipe(hif_dev->udev, 0),
>>  				      FIRMWARE_DOWNLOAD, 0x40 | USB_DIR_OUT,
>> -				      addr >> 8, 0, buf, transfer, HZ);
> 
> 
> Are you sure usb_control_msg() accepts vmalloc()ed buffers ?
> 
> My guess is the answer is no.
> 
> 

I agree, and I would like to drop the patch. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html