linux-kernel - Re: [PATCH RFT] ieee802154: atusb: move to new USB API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YdL0WHrRZpz9tJjX@kroah.com>
Date:   Mon, 3 Jan 2022 14:04:24 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Alexander Aring <alex.aring@...il.com>
Cc:     Pavel Skripkin <paskripkin@...il.com>,
        Stefan Schmidt <stefan@...enfreihafen.org>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        linux-wpan - ML <linux-wpan@...r.kernel.org>,
        "open list:NETWORKING [GENERAL]" <netdev@...r.kernel.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        "# 3.19.x" <stable@...r.kernel.org>,
        Alexander Potapenko <glider@...gle.com>
Subject: Re: [PATCH RFT] ieee802154: atusb: move to new USB API

On Sun, Jan 02, 2022 at 05:15:38PM -0500, Alexander Aring wrote:
> Hi,
> 
> On Sun, 2 Jan 2022 at 12:19, Pavel Skripkin <paskripkin@...il.com> wrote:
> >
> > Alexander reported a use of uninitialized value in
> > atusb_set_extended_addr(), that is caused by reading 0 bytes via
> > usb_control_msg().
> >
> 
> Does there exist no way to check on this and return an error on USB
> API caller level?
> 
> > Since there is an API, that cannot read less bytes, than was requested,
> > let's move atusb driver to use it. It will fix all potintial bugs with
> > uninit values and make code more modern
> >
> 
> If this is not possible to fix with the "old" USB API then I think the
> "old" USB API needs to be fixed.

We can not get rid of the "old" api calls, as sometimes they are needed
for some corner cases where you want to know if you read/wrote a
shorter/larger message than expected.

> Changing to the new USB API as "making the code more modern" is a new
> feature and is a candidate for next.

Fixing bugs is a good thing to do no matter when it happens.

thanks,

greg k-h