linux-kernel - Re: 2.6.24-rc2-mm1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 14 Nov 2007 00:23:32 -0800
From:	Matthew Dharm <mdharm-kernel@...-eyed-alien.net>
To:	Gabriel C <nix.or.die@...glemail.com>
Cc:	Greg KH <greg@...ah.com>, Alan Stern <stern@...land.harvard.edu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, bk@...e.de, khali@...ux-fr.org
Subject: Re: 2.6.24-rc2-mm1

On Wed, Nov 14, 2007 at 06:33:39AM +0100, Gabriel C wrote:
> Matthew Dharm wrote:
> > On Tue, Nov 13, 2007 at 07:49:24PM -0800, Greg KH wrote:
> >> Matt, are these the errors you were worried about with the patch we were
> >> just talking about tha tis in my tree?
> > 
> > I can't tell from these logs.
> 
> There is the dmesg with CONFIG_USB_STORAGE_DEBUG :
> 
> http://194.231.229.228/dmesg-2.6.24-rc2-mm1

Good news: This isn't the bug Greg was worried about.

Bad news: Something is seriously strange here.  Note the following from the
logs:

Nov 14 06:07:43 lara [   41.890614] usb-storage: Bulk Status S 0x53425355 T 0xd R 0 Stat 0x0
Nov 14 06:07:43 lara [   41.890616] usb-storage: -- unexpectedly short transfer

Note the 'R' value of zero -- this is the residue value.  It indicates a
complete transfer, and that matches the log lines immediately previous
which indicate a 4K transfer which completed properly.

If residue is zero, then srb->resid should be zero.  Take a look in
linux/usb/storage/transport.c in usb_stor_Bulk_transport()

If srb->resid is zero, then you should NEVER get the "unexpectedly short
transfer" message.  Look at usb_stor_invoke_transport() in the same file.

In fact, every transfer I look at shows this error.  I didn't exhaustivly
check every single one in the log, but a quick scan suggests that they all
are bogus; good transfer, CSW residue of 0, and "unexpectedly short"
message.

Maybe I'm too tired at this hour, but I just don't see how this is
possible.  Then again, I'm looking at 2.6.22 codebase (it's what I have
handy).

Hrm... does this tree have the "srb accessor" patches in it?  I'm wondering
if somewhere the init srb->resid to 0 before invoking the transport got
lost....

Matt

-- 
Matthew Dharm                              Home: mdharm-usb@...-eyed-alien.net 
Maintainer, Linux USB Mass Storage Driver

Somebody call an exorcist!
					-- Dust Puppy
User Friendly, 5/16/1998

Content of type "application/pgp-signature" skipped