linux-kernel - [PATCH] usb: dwc2: host: fix isoc urb actual length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  6 Nov 2017 16:45:39 +0800
From:   William Wu <william.wu@...k-chips.com>
To:     John.Youn@...opsys.com, balbi@...nel.org,
        gregkh@...uxfoundation.org
Cc:     heiko@...ech.de, linux-kernel@...r.kernel.org,
        linux-usb@...r.kernel.org, linux-rockchip@...ts.infradead.org,
        frank.wang@...k-chips.com, huangtao@...k-chips.com,
        dianders@...gle.com, daniel.meng@...k-chips.com,
        william.wu@...k-chips.com, fml@...k-chips.com
Subject: [PATCH] usb: dwc2: host: fix isoc urb actual length

The actual_length in dwc2_hcd_urb structure is used
to indicate the total data length transferred so far,
but in dwc2_update_isoc_urb_state(), it just updates
the actual_length of isoc frame, and don't update the
urb actual_length at the same time, this will cause
device drivers working error which depend on the urb
actual_length.

we can easily find this issue if use an USB camera，
the userspace use libusb to get USB data from kernel
via devio driver.In usb devio driver, processcompl()
function will process urb complete and copy data to
userspace depending on urb actual_length.

Let's update the urb actual_length if the isoc frame
is valid.

Signed-off-by: William Wu <william.wu@...k-chips.com>
---
 drivers/usb/dwc2/hcd_intr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
index 28a8210..01b1e13 100644
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -580,6 +580,7 @@ static enum dwc2_halt_status dwc2_update_isoc_urb_state(
 		frame_desc->status = 0;
 		frame_desc->actual_length = dwc2_get_actual_xfer_length(hsotg,
 					chan, chnum, qtd, halt_status, NULL);
+		urb->actual_length += frame_desc->actual_length;
 		break;
 	case DWC2_HC_XFER_FRAME_OVERRUN:
 		urb->error_count++;
@@ -599,6 +600,7 @@ static enum dwc2_halt_status dwc2_update_isoc_urb_state(
 		frame_desc->status = -EPROTO;
 		frame_desc->actual_length = dwc2_get_actual_xfer_length(hsotg,
 					chan, chnum, qtd, halt_status, NULL);
+		urb->actual_length += frame_desc->actual_length;

 		/* Skip whole frame */
 		if (chan->qh->do_split &&
-- 
2.0.0