netdev - Re: [PATCH] ath9k_htc: avoid memcpy when downloading firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 02 Mar 2015 22:00:07 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Fred Chou <fred.chou.nd@...il.com>
Cc:	ath9k-devel@....qualcomm.com, kvalo@...eaurora.org,
	linux-wireless@...r.kernel.org, ath9k-devel@...ts.ath9k.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ath9k_htc: avoid memcpy when downloading firmware

On Tue, 2015-03-03 at 12:24 +0800, Fred Chou wrote:
> From: Fred Chou <fred.chou.nd@...il.com>
> 
> The temporary buffer to hold firmware data is not really needed,
> and memcpy can be avoided by using data pointer instead.
> 
> Signed-off-by: Fred Chou <fred.chou.nd@...il.com>
> ---
>  drivers/net/wireless/ath/ath9k/hif_usb.c | 12 ++----------
>  1 file changed, 2 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
> index 10c02f5..0bc35a8 100644
> --- a/drivers/net/wireless/ath/ath9k/hif_usb.c
> +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
> @@ -986,30 +986,22 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
>  	const void *data = hif_dev->fw_data;

Here data can be vmalloc() backed.

>  	size_t len = hif_dev->fw_size;
>  	u32 addr = AR9271_FIRMWARE;
> -	u8 *buf = kzalloc(4096, GFP_KERNEL);

Here buf is kmalloc() backed.

>  	u32 firm_offset;
>  
> -	if (!buf)
> -		return -ENOMEM;
> -
>  	while (len) {
>  		transfer = min_t(size_t, len, 4096);
> -		memcpy(buf, data, transfer);
>  
>  		err = usb_control_msg(hif_dev->udev,
>  				      usb_sndctrlpipe(hif_dev->udev, 0),
>  				      FIRMWARE_DOWNLOAD, 0x40 | USB_DIR_OUT,
> -				      addr >> 8, 0, buf, transfer, HZ);


Are you sure usb_control_msg() accepts vmalloc()ed buffers ?

My guess is the answer is no.


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html