linux-kernel - [PATCH v2 1/2] usb: gadget: loopback: fix: Don't share qlen and buflen between instances

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <1442940898-16176-1-git-send-email-k.opasiak@samsung.com>
Date:	Tue, 22 Sep 2015 18:54:57 +0200
From:	Krzysztof Opasiak <k.opasiak@...sung.com>
To:	balbi@...com, gregkh@...uxfoundation.org
Cc:	linux-kernel@...r.kernel.org, andrzej.p@...sung.com,
	stable@...r.kernel.org, Krzysztof Opasiak <k.opasiak@...sung.com>
Subject: [PATCH v2 1/2] usb: gadget: loopback: fix: Don't share qlen and buflen
 between instances

Each instance of loopback function may have different qlen
and buflen attributes values. When linking function to
configuration those values had been assigned to global
variables. Linking other instance to config overwrites those
values.

This commit moves those values to f_loopback structure
to avoid overwriting. Now each function has its own instance
of those values.

Cc: <stable@...r.kernel.org> # 3.10+
Signed-off-by: Krzysztof Opasiak <k.opasiak@...sung.com>
---
 drivers/usb/gadget/function/f_loopback.c |   24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index 6e2fe63..e4bfed4 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -34,6 +34,9 @@ struct f_loopback {
 
 	struct usb_ep		*in_ep;
 	struct usb_ep		*out_ep;
+
+	unsigned                qlen;
+	unsigned                buflen;
 };
 
 static inline struct f_loopback *func_to_loop(struct usb_function *f)
@@ -41,13 +44,10 @@ static inline struct f_loopback *func_to_loop(struct usb_function *f)
 	return container_of(f, struct f_loopback, function);
 }
 
-static unsigned qlen;
-static unsigned buflen;
-
 /*-------------------------------------------------------------------------*/
 
 static struct usb_interface_descriptor loopback_intf = {
-	.bLength =		sizeof loopback_intf,
+	.bLength =		sizeof(loopback_intf),
 	.bDescriptorType =	USB_DT_INTERFACE,
 
 	.bNumEndpoints =	2,
@@ -253,7 +253,7 @@ static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
 		}
 
 		/* queue the buffer for some later OUT packet */
-		req->length = buflen;
+		req->length = loop->buflen;
 		status = usb_ep_queue(ep, req, GFP_ATOMIC);
 		if (status == 0)
 			return;
@@ -290,7 +290,9 @@ static void disable_loopback(struct f_loopback *loop)
 
 static inline struct usb_request *lb_alloc_ep_req(struct usb_ep *ep, int len)
 {
-	return alloc_ep_req(ep, len, buflen);
+	struct f_loopback	*loop = ep->driver_data;
+
+	return alloc_ep_req(ep, len, loop->buflen);
 }
 
 static int enable_endpoint(struct usb_composite_dev *cdev, struct f_loopback *loop,
@@ -317,7 +319,7 @@ static int enable_endpoint(struct usb_composite_dev *cdev, struct f_loopback *lo
 	 * we buffer at most 'qlen' transfers; fewer if any need more
 	 * than 'buflen' bytes each.
 	 */
-	for (i = 0; i < qlen && result == 0; i++) {
+	for (i = 0; i < loop->qlen && result == 0; i++) {
 		req = lb_alloc_ep_req(ep, 0);
 		if (!req)
 			goto fail1;
@@ -391,10 +393,10 @@ static struct usb_function *loopback_alloc(struct usb_function_instance *fi)
 	lb_opts->refcnt++;
 	mutex_unlock(&lb_opts->lock);
 
-	buflen = lb_opts->bulk_buflen;
-	qlen = lb_opts->qlen;
-	if (!qlen)
-		qlen = 32;
+	loop->buflen = lb_opts->bulk_buflen;
+	loop->qlen = lb_opts->qlen;
+	if (!loop->qlen)
+		loop->qlen = 32;
 
 	loop->function.name = "loopback";
 	loop->function.bind = loopback_bind;
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/