linux-kernel - [PATCH v2] staging: rtl8188eu: fix usb_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 20 Jun 2021 19:40:57 +0200
From:   Martin Kaiser <martin@...ser.cx>
To:     Larry Finger <Larry.Finger@...inger.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-staging@...ts.linux.dev, kernel-janitors@...r.kernel.org,
        linux-kernel@...r.kernel.org, Martin Kaiser <martin@...ser.cx>,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: [PATCH v2] staging: rtl8188eu: fix usb_submit_urb error handling

usb_read_port prepares a bulk in urb and calls usb_submit_urb to pass the
usb to the usb core. It seems wrong that usb_read_port returns success to
its caller if usb_submit_urb failed with -EPERM.

According to drivers/usb/core/urb.c, usb_submit_urb returns -EPERM when
an urb is resubmitted after being cancelled by usb_kill_urb etc.

The only caller who checks the return value of usb_read_port is
rtw_hal_inirp_init. This function submits the bulk in urbs for the first
time after the netdevice is opened. We'll not receive -EPERM from
usb_submit_urb in this case. The urbs are resubmitted by
read_port_complete, which does not check for errors from usb_read_port.

This driver may kill pending bulk in urbs when the netdevice is closed when
the driver is unloaded or the system goes to sleep. I don't think that this
will interrupt an ongoing netdev open.

Suggested-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Martin Kaiser <martin@...ser.cx>
---
v2:
 - improved the commit message based on explanations from Greg and Dan

 drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c b/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c
index ec07b2017fb7..0ceb05f3884f 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_ops_linux.c
@@ -366,7 +366,6 @@ u32 usb_read_port(struct adapter *adapter, u32 addr, struct recv_buf *precvbuf)
 	struct usb_device *pusbd = pdvobj->pusbdev;
 	int err;
 	unsigned int pipe;
-	u32 ret = _SUCCESS;

 	if (adapter->bDriverStopped || adapter->bSurpriseRemoved ||
 	    adapter->pwrctrlpriv.pnp_bstop_trx) {
@@ -403,10 +402,10 @@ u32 usb_read_port(struct adapter *adapter, u32 addr, struct recv_buf *precvbuf)
 			  precvbuf);/* context is precvbuf */

 	err = usb_submit_urb(purb, GFP_ATOMIC);
-	if ((err) && (err != (-EPERM)))
-		ret = _FAIL;
+	if (err)
+		return _FAIL;

-	return ret;
+	return _SUCCESS;
 }

 void rtw_hal_inirp_deinit(struct adapter *padapter)
-- 
2.20.1