linux-kernel - Re: [stable] [patch 00/48] 2.6.27.32-stable review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AB387E3.6030709@imap.cc>
Date:	Fri, 18 Sep 2009 15:15:15 +0200
From:	Tilman Schmidt <tilman@...p.cc>
To:	Greg KH <greg@...ah.com>
CC:	Greg KH <gregkh@...e.de>, linux-kernel@...r.kernel.org,
	stable@...nel.org, akpm@...ux-foundation.org,
	torvalds@...ux-foundation.org, stable-review@...nel.org,
	alan@...rguk.ukuu.org.uk
Subject: Re: [stable] [patch 00/48] 2.6.27.32-stable review

Am 16.09.2009 23:09 schrieb Greg KH:
> Can you send me what you need applied to the latest 2.6.27-stable tree
> to fix this up so we can finally resolve this?

The patch that should have been applied is here:

http://patchwork.kernel.org/patch/13845/

I'm including it below for completeness.

The patch that was applied to 2.6.27-stable instead is this:

http://patchwork.kernel.org/patch/20855/
(commit 221418f9a25cd96aff99d6aba41c177f6eb00853)

The difference is in blob 5 which inserts the new code at the wrong place.
I have no idea who or what caused that change.

So commit 221418f9a25cd96aff99d6aba41c177f6eb00853 should be reverted and
my original patch below applied instead. The patch by Stefan Bader is
equivalent to that but additionally backports two pr_err() calls from
mainline.

Thanks,
Tilman



-------- Original-Nachricht --------
Betreff: [PATCH 2.6.27/28-stable] bas_gigaset: correctly allocate USB interrupt transfer buffer
Datum: Mon, 23 Mar 2009 22:47:06 +0100 (CET)
Von: Tilman Schmidt <tilman@...p.cc>
An: stable@...nel.org
CC: Kolja Waschk <kawk@...rs.sourceforge.net>, Hansjoerg Lipp <hjlipp@....de>, davem@...emloft.net, linux-kernel@...r.kernel.org,        netdev@...r.kernel.org

Greg,

the following patch backports the Gigaset driver bugfix merged for
2.6.29 as commit 170ebf85160dd128e1c4206cc197cce7d1424705 to both
v2.6.27.x and v2.6.28.x. I would appreciate to see it included in
your stable series.

Thanks,
Tilman

bas_gigaset: correctly allocate USB interrupt transfer buffer

commit 170ebf85160dd128e1c4206cc197cce7d1424705 upstream.

Every USB transfer buffer has to be allocated individually by kmalloc.

Impact: bugfix, no functional change

Signed-off-by: Tilman Schmidt <tilman@...p.cc>
Tested-by: Kolja Waschk <kawk@...rs.sourceforge.net>
---
 drivers/isdn/gigaset/bas-gigaset.c |   15 +++++++++++++---
 1 files changed, 12 insertions(+), 3 deletions(-)

--- a/drivers/isdn/gigaset/bas-gigaset.c	2008-12-25 00:26:37.000000000 +0100
+++ b/drivers/isdn/gigaset/bas-gigaset.c	2009-03-17 23:38:30.000000000 +0100
@@ -46,6 +46,9 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode"
 /* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
 #define IF_WRITEBUF 264
 
+/* interrupt pipe message size according to ibid. ch. 2.2 */
+#define IP_MSGSIZE 3
+
 /* Values for the Gigaset 307x */
 #define USB_GIGA_VENDOR_ID      0x0681
 #define USB_3070_PRODUCT_ID     0x0001
@@ -110,7 +113,7 @@ struct bas_cardstate {
 	unsigned char		*rcvbuf;	/* AT reply receive buffer */
 
 	struct urb		*urb_int_in;	/* URB for interrupt pipe */
-	unsigned char		int_in_buf[3];
+	unsigned char		*int_in_buf;
 
 	spinlock_t		lock;		/* locks all following */
 	int			basstate;	/* bitmap (BS_*) */
@@ -657,7 +660,7 @@ static void read_int_callback(struct urb
 	}
 
 	/* drop incomplete packets even if the missing bytes wouldn't matter */
-	if (unlikely(urb->actual_length < 3)) {
+	if (unlikely(urb->actual_length < IP_MSGSIZE)) {
 		dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
 			 urb->actual_length);
 		goto resubmit;
@@ -2127,6 +2130,7 @@ static void gigaset_reinitbcshw(struct b
 static void gigaset_freecshw(struct cardstate *cs)
 {
 	/* timers, URBs and rcvbuf are disposed of in disconnect */
+	kfree(cs->hw.bas->int_in_buf);
 	kfree(cs->hw.bas);
 	cs->hw.bas = NULL;
 }
@@ -2138,6 +2142,11 @@ static int gigaset_initcshw(struct cards
 	cs->hw.bas = ucs = kmalloc(sizeof *ucs, GFP_KERNEL);
 	if (!ucs)
 		return 0;
+	ucs->int_in_buf = kmalloc(IP_MSGSIZE, GFP_KERNEL);
+	if (!ucs->int_in_buf) {
+		kfree(ucs);
+		return 0;
+	}
 
 	ucs->urb_cmd_in = NULL;
 	ucs->urb_cmd_out = NULL;
@@ -2290,7 +2299,7 @@ static int gigaset_probe(struct usb_inte
 	usb_fill_int_urb(ucs->urb_int_in, udev,
 			 usb_rcvintpipe(udev,
 					(endpoint->bEndpointAddress) & 0x0f),
-			 ucs->int_in_buf, 3, read_int_callback, cs,
+			 ucs->int_in_buf, IP_MSGSIZE, read_int_callback, cs,
 			 endpoint->bInterval);
 	if ((rc = usb_submit_urb(ucs->urb_int_in, GFP_KERNEL)) != 0) {
 		dev_err(cs->dev, "could not submit interrupt URB: %s\n",



-- 
Tilman Schmidt                    E-Mail: tilman@...p.cc
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)


Download attachment "signature.asc" of type "application/pgp-signature" (255 bytes)