netdev - Re: [PATCH v2] net: usb: ax88179_178a: ax88179_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 20 Jun 2022 22:18:41 -0300
From:   Jose Alonso <joalonsof@...il.com>
To:     David Laight <David.Laight@...LAB.COM>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH v2] net: usb: ax88179_178a: ax88179_rx_fixup corrections


On Mon, 2022-06-20 at 03:45 +0000, David Laight wrote:
> 
> > -                       ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
> 
> You've 'lost' this lie.
> IIRC the 'skb' are allocated with 64k buffer space.
> I'm not at all sure how the buffer space of skb that are cloned
> into multiple rx buffers are supposed to be accounted for.
> 
> Does this driver ever copy the data for short frames?

The driver receives a skb with a URB (dev->rx_urb_size=24576)
with N packets and do skb->clone for the N-1 first packets and
for the last return the skb received.
The usb transfer uses bulk io of 512 bytes (dev->maxpacket).
skb_clone creates a new sk_buff sharing the same skb->data avoiding
extra copy of the packets and the URB area will be released when
all packets were processed (reference count = 0).
The length of rx queue is setted by usbnet:
#define MAX_QUEUE_MEMORY        (60 * 1518)
...
        case USB_SPEED_HIGH:
                dev->rx_qlen = MAX_QUEUE_MEMORY / dev->rx_urb_size;
                dev->tx_qlen = MAX_QUEUE_MEMORY / dev->hard_mtu;
                break;
        case USB_SPEED_SUPER:
        case USB_SPEED_SUPER_PLUS:
		...
                dev->rx_qlen = 5 * MAX_QUEUE_MEMORY / dev->rx_urb_size;
                dev->tx_qlen = 5 * MAX_QUEUE_MEMORY / dev->hard_mtu;

> 
> There ought to be an error count here.
yes.
> I know there wasn't one before.
> 
>         David

Jose Alonso