linux-kernel - Re: [PATCH] isdn: bas_gigaset: use usb_fill_int

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 05 May 2019 09:55:19 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     pebolle@...cali.nl
Cc:     netdev@...r.kernel.org, bigeasy@...utronix.de,
        gigaset307x-common@...ts.sourceforge.net,
        linux-kernel@...r.kernel.org, arnd@...db.de
Subject: Re: [PATCH] isdn: bas_gigaset: use usb_fill_int_urb() properly

From: Paul Bolle <pebolle@...cali.nl>
Date: Wed,  1 May 2019 23:19:03 +0200

> The switch to make bas_gigaset use usb_fill_int_urb() - instead of
> filling that urb "by hand" - missed the subtle ordering of the previous
> code.
> 
> See, before the switch urb->dev was set to a member somewhere deep in a
> complicated structure and then supplied to usb_rcvisocpipe() and
> usb_sndisocpipe(). After that switch urb->dev wasn't set to anything
> specific before being supplied to those two macros. This triggers a
> nasty oops:
...
> No-one noticed because this Oops is apparently only triggered by setting
> up an ISDN data connection on a live ISDN line on a gigaset base (ie,
> the PBX that the gigaset driver support). Very few people do that
> running present day kernels.
> 
> Anyhow, a little code reorganization makes this problem go away, while
> avoiding the subtle ordering that was used in the past. So let's do
> that.
> 
> Fixes: 78c696c19578 ("isdn: gigaset: use usb_fill_int_urb()")
> Signed-off-by: Paul Bolle <pebolle@...cali.nl>
> ---
> Arnd's ISDN cleanup hasn't yet hit net-next so this still uses
> drivers/isdn. If people prefer to apply this after Arnd has exiled
> gigaset into staging, I'll gladly respin. 

Applied to 'net', queued up for -stable, and I'll deal with the
merge conflict :-/ :-) :-)