linux-kernel - Re: REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 12 Oct 2012 11:10:36 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Henrik Rydberg <rydberg@...omail.se>
cc:	Hans de Goede <hdegoede@...hat.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Peter Stuge <peter@...ge.se>
Subject: Re: REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers

On Fri, 12 Oct 2012, Henrik Rydberg wrote:

> Hi Alan,
> 
> > Instead of introducing a new local variable, why not simply update 
> > uurb->buffer?  That's what we do elsewhere in the code.
> 
> It seemed fragile, due to these scary lines:
> 
> 	if (is_in && uurb->buffer_length > 0)
> 		as->userbuffer = uurb->buffer;
> 	else
> 		as->userbuffer = NULL;
> 
> I suppose it works in this particular case.  How is the
> USBDEVFS_URB_TYPE_CONTROL case supposed to work here?

It's understood that for control transfers, the setup part of the 
buffer remains unchanged.  The data transfer starts at the eighth byte 
of the buffer.

> I can certainly change the patch if preferred. Tested and attached
> below.
> 
> Thanks,
> Henrik
> 
> From 40b70394747eea51fdd07cc8213dd6afd24b1b30 Mon Sep 17 00:00:00 2001
> From: Henrik Rydberg <rydberg@...omail.se>
> Date: Thu, 11 Oct 2012 23:27:04 +0200
> Subject: [PATCH v2] usbdevfs: Fix broken scatter-gather transfer
> 
> The handling of large output bulk transfers is broken; the same user
> page is read over and over again. Fixed with this patch.
> 
> Signed-off-by: Henrik Rydberg <rydberg@...omail.se>
> ---
>  drivers/usb/core/devio.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index ebb8a9d..6e58b59 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1349,6 +1351,7 @@
>  					goto error;
>  				}
>  			}
> +			uurb->buffer += u;
>  			totlen -= u;
>  		}
>  	} else if (uurb->buffer_length > 0) {

Acked-by: Alan Stern <stern@...land.harvard.edu>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/