linux-kernel - Re: REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.1210121018390.1605-100000@iolanthe.rowland.org>
Date:	Fri, 12 Oct 2012 10:25:23 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Henrik Rydberg <rydberg@...omail.se>
cc:	Hans de Goede <hdegoede@...hat.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Peter Stuge <peter@...ge.se>
Subject: Re: REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers

On Thu, 11 Oct 2012, Henrik Rydberg wrote:

> From 40b70394747eea51fdd07cc8213dd6afd24b1b30 Mon Sep 17 00:00:00 2001
> From: Henrik Rydberg <rydberg@...omail.se>
> Date: Thu, 11 Oct 2012 23:27:04 +0200
> Subject: [PATCH] usbdevfs: Fix broken scatter-gather transfer
> 
> The recently introduced handling of large bulk transfers is completely
> broken; the same user page is read over and over again. Fixed with
> this patch.
> 
> Cc: stable@...nel.org
> Signed-off-by: Henrik Rydberg <rydberg@...omail.se>
> ---
>  drivers/usb/core/devio.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index ebb8a9d..6e58b59 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1172,6 +1172,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
>  	struct usb_ctrlrequest *dr = NULL;
>  	unsigned int u, totlen, isofrmlen;
>  	int i, ret, is_in, num_sgs = 0, ifnum = -1;
> +	void __user *userbuf;
>  	void *buf;
>  
>  	if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
> @@ -1333,6 +1334,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
>  		as->urb->num_sgs = num_sgs;
>  		sg_init_table(as->urb->sg, as->urb->num_sgs);
>  
> +		userbuf = uurb->buffer;
>  		totlen = uurb->buffer_length;
>  		for (i = 0; i < as->urb->num_sgs; i++) {
>  			u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
> @@ -1344,11 +1346,12 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
>  			sg_set_buf(&as->urb->sg[i], buf, u);
>  
>  			if (!is_in) {
> -				if (copy_from_user(buf, uurb->buffer, u)) {
> +				if (copy_from_user(buf, userbuf, u)) {
>  					ret = -EFAULT;
>  					goto error;
>  				}
>  			}
> +			userbuf += u;

Instead of introducing a new local variable, why not simply update 
uurb->buffer?  That's what we do elsewhere in the code.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/