linux-kernel - Re: [PATCH] media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZjC7rXU7ViaH60_S@gofer.mess.org>
Date: Tue, 30 Apr 2024 10:36:45 +0100
From: Sean Young <sean@...s.org>
To: Zheng Yejian <zhengyejian1@...wei.com>
Cc: mchehab@...nel.org, linux-media@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] media: dvb-usb: Fix unexpected infinite loop in
 dvb_usb_read_remote_control()

On Tue, Apr 30, 2024 at 05:19:56PM +0800, Zheng Yejian wrote:
> Thanks for your suggestion!
> Do you mean the following change? If it is ok, I'll send a v2!
> 
> diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
> index fbf58012becd..2a8395d6373c 100644
> --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
> +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
> @@ -23,6 +23,23 @@ static int dvb_usb_force_pid_filter_usage;
>  module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444);
>  MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0).");
> 
> +static int dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint)

I don't think this is a good function name; we are checking that the
endpoint is correct and also clearing halts.

How about: dvb_usb_check_bulk_endpoint()

Looks good otherwise

Sean

> +{
> +       if (endpoint) {
> +               int ret;
> +
> +               ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint));
> +               if (ret)
> +                       return ret;
> +               ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint));
> +               if (ret)
> +                       return ret;
> +               usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint));
> +               usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint));
> +       }
> +       return 0;
> +}
> +
>  static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
>  {
>         struct dvb_usb_adapter *adap;
> @@ -103,10 +120,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs)
>          * when reloading the driver w/o replugging the device
>          * sometimes a timeout occurs, this helps
>          */
> -       if (d->props.generic_bulk_ctrl_endpoint != 0) {
> -               usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint));
> -               usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint));
> -       }
> +       ret = dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint);
> +       if (ret)
> +               goto frontend_init_err;
> +       ret = dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response);
> +       if (ret)
> +               goto frontend_init_err;
> 
>         return 0;
> 
> --
> Thanks,
> Zheng Yejian
> 
> > Thanks
> > 
> > Sean
>