linux-kernel - Re: [PATCH] USB: add USB test and measurement class driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 27 Aug 2008 09:08:54 -0700
From:	Greg KH <greg@...ah.com>
To:	Oliver Neukum <oliver@...kum.org>
Cc:	linux-usb@...r.kernel.org, Stefan Kopp <stefan_kopp@...lent.com>,
	Marcel Janssen <korgull@...e.nl>,
	Felipe Balbi <me@...ipebalbi.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] USB: add USB test and measurement class driver

On Wed, Aug 27, 2008 at 10:13:06AM +0200, Oliver Neukum wrote:
> Am Mittwoch 27 August 2008 02:05:01 schrieb Greg KH:
> > +static ssize_t usbtmc_read(struct file *filp, char __user *buf,
> > +                          size_t count, loff_t *f_pos)
> > +{
> > +       struct usbtmc_device_data *data;
> > +       struct device *dev;
> > +       unsigned long int n_characters;
> > +       u8 *buffer;
> > +       int actual;
> > +       int done;
> > +       int remaining;
> > +       int retval;
> > +       int this_part;
> > +
> > +       /* Get pointer to private data structure */
> > +       data = filp->private_data;
> > +       dev = &data->intf->dev;
> > +       buffer = data->buffer;
> > +
> > +       remaining = count;
> > +       done = 0;
> > +
> > +       while (remaining > 0) {
> > +               if (remaining > USBTMC_SIZE_IOBUFFER - 12 - 3)
> > +                       this_part = USBTMC_SIZE_IOBUFFER - 12 - 3;
> > +               else
> > +                       this_part = remaining;
> > +
> > +               /* Setup IO buffer for DEV_DEP_MSG_IN message
> > +                * Refer to class specs for details
> > +                */
> > +               buffer[0] = 2;
> > +               buffer[1] = data->bTag;
> > +               buffer[2] = ~(data->bTag);
> > +               buffer[3] = 0; /* Reserved */
> > +               buffer[4] = (this_part - 12 - 3) & 255;
> > +               buffer[5] = ((this_part - 12 - 3) >> 8) & 255;
> > +               buffer[6] = ((this_part - 12 - 3) >> 16) & 255;
> > +               buffer[7] = ((this_part - 12 - 3) >> 24) & 255;
> > +               buffer[8] = data->TermCharEnabled * 2;
> > +               /* Use term character? */
> > +               buffer[9] = data->TermChar;
> > +               buffer[10] = 0; /* Reserved */
> > +               buffer[11] = 0; /* Reserved */
> 
> This function will go bad if concurrent readers enter, yet it has no locking.

Now fixed with an i/o mutex.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/