linux-kernel - Re: [PATCH 2/2] usb: storage: rearrange triple nested CSW data phase check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <27c07b90-f4ef-462b-8b6d-46afd4301912@rowland.harvard.edu>
Date: Wed, 29 Oct 2025 17:54:25 -0400
From: Alan Stern <stern@...land.harvard.edu>
To: Desnes Nunes <desnesn@...hat.com>
Cc: linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
	gregkh@...uxfoundation.org
Subject: Re: [PATCH 2/2] usb: storage: rearrange triple nested CSW data phase
 check

On Wed, Oct 29, 2025 at 04:14:14PM -0300, Desnes Nunes wrote:
> This rearranges the triple nested CSW data phase if clause, in order to
> make usb_stor_Bulk_transport() code more readlable. No functional change.
> 
> Signed-off-by: Desnes Nunes <desnesn@...hat.com>
> ---
>  drivers/usb/storage/transport.c | 21 ++++++++++-----------
>  1 file changed, 10 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
> index 96b81cf6adc7..3f2e1df5ad1e 100644
> --- a/drivers/usb/storage/transport.c
> +++ b/drivers/usb/storage/transport.c
> @@ -1188,18 +1188,17 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
>  		 * check whether it really is a CSW.
>  		 */
>  		if (result == USB_STOR_XFER_SHORT &&
> -				srb->sc_data_direction == DMA_FROM_DEVICE &&
> -				transfer_length - scsi_get_resid(srb) ==
> -					US_BULK_CS_WRAP_LEN) {
> +		    srb->sc_data_direction == DMA_FROM_DEVICE &&
> +		    transfer_length - scsi_get_resid(srb) == US_BULK_CS_WRAP_LEN) {

This change has nothing to do with the subject of the patch.  Please 
leave the code the way it was.

>  			struct scatterlist *sg = NULL;
> -			unsigned int offset = 0;
> -
> -			if (usb_stor_access_xfer_buf((unsigned char *) bcs,
> -					US_BULK_CS_WRAP_LEN, srb, &sg,
> -					&offset, FROM_XFER_BUF) ==
> -						US_BULK_CS_WRAP_LEN &&
> -					bcs->Signature ==
> -						cpu_to_le32(US_BULK_CS_SIGN)) {
> +			unsigned int offset = 0, buflen = 0;

It seems silly to initialize buflen to 0 when the very next statement is 
going to overwrite that value.

Also, "buflen" is not a good name for this variable, because the 
variable does not contain the length of a buffer.  Rather, it will 
contain the amount of data that got transferred by the 
usb_stor_access_xfer_buf() routine.  The following "if" statement then 
tests whether that amount is equal to the buffer length.

Alan Stern

> +
> +			buflen = usb_stor_access_xfer_buf((unsigned char *) bcs,
> +						US_BULK_CS_WRAP_LEN, srb, &sg,
> +						&offset, FROM_XFER_BUF);
> +
> +			if (buflen == US_BULK_CS_WRAP_LEN &&
> +			    bcs->Signature == cpu_to_le32(US_BULK_CS_SIGN)) {
>  				unsigned char buf[US_BULK_CS_WRAP_LEN];
>  
>  				sg = NULL;
> -- 
> 2.50.1
>