linux-kernel - Re: REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121012150800.GA3097@polaris.bitmath.org>
Date:	Fri, 12 Oct 2012 17:08:00 +0200
From:	"Henrik Rydberg" <rydberg@...omail.se>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Hans de Goede <hdegoede@...hat.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	Peter Stuge <peter@...ge.se>
Subject: Re: REGRESSION: usbdevfs:
 Use-scatter-gather-lists-for-large-bulk-transfers

Hi Alan,

> Instead of introducing a new local variable, why not simply update 
> uurb->buffer?  That's what we do elsewhere in the code.

It seemed fragile, due to these scary lines:

	if (is_in && uurb->buffer_length > 0)
		as->userbuffer = uurb->buffer;
	else
		as->userbuffer = NULL;

I suppose it works in this particular case.  How is the
USBDEVFS_URB_TYPE_CONTROL case supposed to work here?

I can certainly change the patch if preferred. Tested and attached
below.

Thanks,
Henrik

>From 40b70394747eea51fdd07cc8213dd6afd24b1b30 Mon Sep 17 00:00:00 2001
From: Henrik Rydberg <rydberg@...omail.se>
Date: Thu, 11 Oct 2012 23:27:04 +0200
Subject: [PATCH v2] usbdevfs: Fix broken scatter-gather transfer

The handling of large output bulk transfers is broken; the same user
page is read over and over again. Fixed with this patch.

Signed-off-by: Henrik Rydberg <rydberg@...omail.se>
---
 drivers/usb/core/devio.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index ebb8a9d..6e58b59 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1349,6 +1351,7 @@
 					goto error;
 				}
 			}
+			uurb->buffer += u;
 			totlen -= u;
 		}
 	} else if (uurb->buffer_length > 0) {

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/