netdev - Re: Active URB submitted twice in pegasus driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1304051946020.7054@fry>
Date:	Fri, 5 Apr 2013 20:01:03 +0300 (EEST)
From:	Petko Manolov <petkan@...leusys.com>
To:	Sarah Sharp <sarah.a.sharp@...ux.intel.com>
cc:	linux-usb@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>,
	netdev@...r.kernel.org,
	Stephen Hemminger <stephen@...workplumber.org>
Subject: Re: Active URB submitted twice in pegasus driver

On Wed, 27 Mar 2013, Petko Manolov wrote:

> On Tue, 26 Mar 2013, Sarah Sharp wrote:
>
>> ctrl_callback is still reading the URB status, and using it in the
>> switch statement.  It's also using the urb->context as well, to dig out
>> a pointer (pegasus_t) that the pegasus_set_multicast already has access
>> to.  What happens if an URB to get the registers completes at the same
>> time pegasus_set_multicast calls ctrl_callback?  If the URB failed for
>> some reason (e.g. bad cable, stall), you'll miss that if statement.  I
>> don't think that's what you intended to do.
>> 
>> I think the fix should be to just to move the if block into a new
>> function, and call it both in ctrl_callback() and
>> pegasus_set_multicast().
>
> The _real_ fix would be to rework the whole callback mechanism, but this is a 
> different story.  It is in my todo list.

Attached you'll find two patches against Linus' 3.9.0-rc5.  These should 
effectively cure the broken control requests callback logic.  The patch is 
so big because i also cleaned up a lot of old cruft.

The new driver actually compiles and runs fine with Pegasus-II based 
device.  Please let me know if you run into problems.


cheers,
Petko
View attachment "pegasus.h.diff" of type "TEXT/x-diff" (1246 bytes)

View attachment "pegasus.c.diff" of type "TEXT/x-diff" (21453 bytes)