linux-kernel - Re: [PATCH] USB: add USB test and measurement class driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200808271013.07561.oliver@neukum.org>
Date:	Wed, 27 Aug 2008 10:13:06 +0200
From:	Oliver Neukum <oliver@...kum.org>
To:	Greg KH <greg@...ah.com>
Cc:	linux-usb@...r.kernel.org, Stefan Kopp <stefan_kopp@...lent.com>,
	Marcel Janssen <korgull@...e.nl>,
	Felipe Balbi <me@...ipebalbi.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] USB: add USB test and measurement class driver

Am Mittwoch 27 August 2008 02:05:01 schrieb Greg KH:
> +static ssize_t usbtmc_read(struct file *filp, char __user *buf,
> +                          size_t count, loff_t *f_pos)
> +{
> +       struct usbtmc_device_data *data;
> +       struct device *dev;
> +       unsigned long int n_characters;
> +       u8 *buffer;
> +       int actual;
> +       int done;
> +       int remaining;
> +       int retval;
> +       int this_part;
> +
> +       /* Get pointer to private data structure */
> +       data = filp->private_data;
> +       dev = &data->intf->dev;
> +       buffer = data->buffer;
> +
> +       remaining = count;
> +       done = 0;
> +
> +       while (remaining > 0) {
> +               if (remaining > USBTMC_SIZE_IOBUFFER - 12 - 3)
> +                       this_part = USBTMC_SIZE_IOBUFFER - 12 - 3;
> +               else
> +                       this_part = remaining;
> +
> +               /* Setup IO buffer for DEV_DEP_MSG_IN message
> +                * Refer to class specs for details
> +                */
> +               buffer[0] = 2;
> +               buffer[1] = data->bTag;
> +               buffer[2] = ~(data->bTag);
> +               buffer[3] = 0; /* Reserved */
> +               buffer[4] = (this_part - 12 - 3) & 255;
> +               buffer[5] = ((this_part - 12 - 3) >> 8) & 255;
> +               buffer[6] = ((this_part - 12 - 3) >> 16) & 255;
> +               buffer[7] = ((this_part - 12 - 3) >> 24) & 255;
> +               buffer[8] = data->TermCharEnabled * 2;
> +               /* Use term character? */
> +               buffer[9] = data->TermChar;
> +               buffer[10] = 0; /* Reserved */
> +               buffer[11] = 0; /* Reserved */

This function will go bad if concurrent readers enter, yet it has no locking.

	Regards
		Oliver