linux-kernel - Re: [PATCH 1/1] mfd: rtsx_usb: avoid setting ucr->current

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160830143906.GM10121@dell>
Date:   Tue, 30 Aug 2016 15:39:06 +0100
From:   Lee Jones <lee.jones@...aro.org>
To:     Lu Baolu <baolu.lu@...ux.intel.com>
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org, Alan Stern <stern@...land.harvard.edu>,
        Roger Tseng <rogerable@...ltek.com>
Subject: Re: [PATCH 1/1] mfd: rtsx_usb: avoid setting ucr->current_sg.status

On Thu, 11 Aug 2016, Lu Baolu wrote:

> Member "status" of struct usb_sg_request is managed by usb core. A
> spin lock is used to serialize the change of it. The driver could
> check the value of req->status, but should avoid changing it without
> the hold of the spinlock. Otherwise, it could cause race or error
> in usb core.
> 
> This patch could be backported to stable kernels with version later
> than v3.14.
> 
> Cc: stable@...r.kernel.org # 3.14+
> Cc: Alan Stern <stern@...land.harvard.edu>
> Cc: Roger Tseng <rogerable@...ltek.com>
> Signed-off-by: Lu Baolu <baolu.lu@...ux.intel.com>
> ---
>  drivers/mfd/rtsx_usb.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

Applied, thanks.

> diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
> index dbd907d..691dab7 100644
> --- a/drivers/mfd/rtsx_usb.c
> +++ b/drivers/mfd/rtsx_usb.c
> @@ -46,9 +46,6 @@ static void rtsx_usb_sg_timed_out(unsigned long data)
>  
>  	dev_dbg(&ucr->pusb_intf->dev, "%s: sg transfer timed out", __func__);
>  	usb_sg_cancel(&ucr->current_sg);
> -
> -	/* we know the cancellation is caused by time-out */
> -	ucr->current_sg.status = -ETIMEDOUT;
>  }
>  
>  static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
> @@ -67,12 +64,15 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
>  	ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
>  	add_timer(&ucr->sg_timer);
>  	usb_sg_wait(&ucr->current_sg);
> -	del_timer_sync(&ucr->sg_timer);
> +	if (!del_timer_sync(&ucr->sg_timer))
> +		ret = -ETIMEDOUT;
> +	else
> +		ret = ucr->current_sg.status;
>  
>  	if (act_len)
>  		*act_len = ucr->current_sg.bytes;
>  
> -	return ucr->current_sg.status;
> +	return ret;
>  }
>  
>  int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe,

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog