linux-kernel - Re: [PATCH 1/2] staging: r8188eu: Use usb_control_msg_recv/send() in usbctrl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50d40020-5b0e-4bb9-357b-3640a0f9e8c6@wanadoo.fr>
Date:   Tue, 24 Aug 2021 07:44:40 +0200
From:   Christophe JAILLET <christophe.jaillet@...adoo.fr>
To:     "Fabio M. De Francesco" <fmdefrancesco@...il.com>,
        Phillip Potter <phil@...lpotter.co.uk>
Cc:     Larry Finger <Larry.Finger@...inger.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "open list:STAGING SUBSYSTEM" <linux-staging@...ts.linux.dev>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Pavel Skripkin <paskripkin@...il.com>
Subject: Re: [PATCH 1/2] staging: r8188eu: Use usb_control_msg_recv/send() in
 usbctrl_vendorreq()

Le 24/08/2021 à 04:01, Fabio M. De Francesco a écrit :
> On Tuesday, August 24, 2021 3:38:03 AM CEST Fabio M. De Francesco wrote:
>> I think that I've inadvertently switched the order by which usb_control_msg_send()
>> and memcpy() are called. I'm very sorry for not doing my tests, but (as I had said
>> before) at the moment I don't have my device with me.
> 
> No, I did not switch them. There must be something else...
> Sorry for the noise.
> 
> Fabio
> 

Hi,

'usb_control_msg_recv()' looks like:

int usb_control_msg_recv(struct usb_device *dev, __u8 endpoint, ...)
{
	unsigned int pipe = usb_rcvctrlpipe(dev, endpoint);
	...
	ret = usb_control_msg(dev, pipe, ...);


'usb_control_msg()' looks like:
int usb_control_msg(struct usb_device *dev, unsigned int pipe, ...)
{


The difference is that one expect an 'endpoint' (and compute the pipe 
from it), and the other expect a 'pipe'.

Also, in your code, 'pipe' looks un-initialized.


So, my guess is that you should rename 'pipe' into 'endpoint' (to keep 
the semantic), have "endpoint = 0;" somewhere and pass it to 
usb_control_msg_{recv|send}.
Or just remove 'pipe' and pass an explicit 0 directly.

Not sure it is enough, but it looks like a difference between before and 
after your patch.


just my 2c,
CJ