linux-kernel - [PATCH] mos7840: fix chars_in

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sat, 24 Sep 2016 16:48:32 +0300
From:   Stas Sergeev <stsp@...t.ru>
To:     stsp@...t.ru
Cc:     Caylan Van Larson <i@...lan.net>,
        Alan Cox <alan@...rguk.ukuu.org.uk>,
        Johan Hovold <johan@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] mos7840: fix chars_in_buffer() return value

The TIOCOUTQ ioctl calls chars_in_buffer(), and some apps depend on
a correct behaviour of that.
mos7840 implements it wrongly: if you write just one char, TIOCOUTQ
will return 32.
This patch should fix it by accounting the number of chars actually
written.
This patch, unfortunately, misses the Tesed-by tag.
The reported didn't test it, and I don't have the hardware in question.

Signed-off-by: Stas Sergeev <stsp@...t.ru>
Reported-by: Caylan Van Larson <i@...lan.net>
CC: Caylan Van Larson <i@...lan.net>
CC: Alan Cox <alan@...rguk.ukuu.org.uk>
CC: Johan Hovold <johan@...nel.org>
CC: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC: linux-usb@...r.kernel.org
CC: linux-kernel@...r.kernel.org
---
 drivers/usb/serial/mos7840.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index ed378fb..2a1eb07 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -234,7 +234,7 @@ struct moschip_port {
 
 	spinlock_t pool_lock;
 	struct urb *write_urb_pool[NUM_URBS];
-	char busy[NUM_URBS];
+	int busy[NUM_URBS];
 	bool read_urb_busy;
 
 	/* For device(s) with LED indicator */
@@ -1139,8 +1139,7 @@ static int mos7840_chars_in_buffer(struct tty_struct *tty)
 	spin_lock_irqsave(&mos7840_port->pool_lock, flags);
 	for (i = 0; i < NUM_URBS; ++i) {
 		if (mos7840_port->busy[i]) {
-			struct urb *urb = mos7840_port->write_urb_pool[i];
-			chars += urb->transfer_buffer_length;
+			chars += mos7840_port->busy[i];
 		}
 	}
 	spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
@@ -1323,10 +1322,11 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
 	/* try to find a free urb in the list */
 	urb = NULL;
 
+	transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
 	spin_lock_irqsave(&mos7840_port->pool_lock, flags);
 	for (i = 0; i < NUM_URBS; ++i) {
 		if (!mos7840_port->busy[i]) {
-			mos7840_port->busy[i] = 1;
+			mos7840_port->busy[i] = transfer_size;
 			urb = mos7840_port->write_urb_pool[i];
 			dev_dbg(&port->dev, "URB:%d\n", i);
 			break;
@@ -1345,7 +1345,6 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
 		if (!urb->transfer_buffer)
 			goto exit;
 	}
-	transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
 
 	memcpy(urb->transfer_buffer, current_position, transfer_size);
 
-- 
2.7.4