linux-kernel - Re: [PATCH] usbnet: test off by one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.0912291504520.2335@fry.nucleusys.com>
Date:	Tue, 29 Dec 2009 15:13:28 +0200 (EET)
From:	Petko Manolov <petkan@...leusys.com>
To:	Roel Kluin <roel.kluin@...il.com>
cc:	Petko Manolov <petkan@...rs.sourceforge.net>,
	linux-usb@...r.kernel.org, netdev@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] usbnet: test off by one

 	Hey Roel,

MII_TIMEOUT is a number i made up myself, reasonably small so the driver 
won't sit there forever, but higher than 2.  While testing the gadget i 
discovered that reading MII registers sometimes require more than one 
attempt.

Technically you're right.  In practice it doesn't matter much.  Hitting 
the boundary condition mean things are already out of hand.


 		Petko



On Sun, 27 Dec 2009, Roel Kluin wrote:

> With `while (i++ < MII_TIMEOUT)' i reaches MII_TIMEOUT + 1 after the loop
> This is probably unlikely a problem in practice.
>
> Signed-off-by: Roel Kluin <roel.kluin@...il.com>
> ---
> drivers/net/usb/rtl8150.c |    4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
> index f14d225..fd19db0 100644
> --- a/drivers/net/usb/rtl8150.c
> +++ b/drivers/net/usb/rtl8150.c
> @@ -270,7 +270,7 @@ static int read_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 * reg)
> 		get_registers(dev, PHYCNT, 1, data);
> 	} while ((data[0] & PHY_GO) && (i++ < MII_TIMEOUT));
>
> -	if (i < MII_TIMEOUT) {
> +	if (i <= MII_TIMEOUT) {
> 		get_registers(dev, PHYDAT, 2, data);
> 		*reg = data[0] | (data[1] << 8);
> 		return 0;
> @@ -295,7 +295,7 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
> 		get_registers(dev, PHYCNT, 1, data);
> 	} while ((data[0] & PHY_GO) && (i++ < MII_TIMEOUT));
>
> -	if (i < MII_TIMEOUT)
> +	if (i <= MII_TIMEOUT)
> 		return 0;
> 	else
> 		return 1;
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/