lkml.org 
[lkml]   [2010]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[063/116] USB: fix usbfs regression
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Alan Stern <stern@rowland.harvard.edu>

    commit 7152b592593b9d48b33f8997b1dfd6df9143f7ec upstream.

    This patch (as1352) fixes a bug in the way isochronous input data is
    returned to userspace for usbfs transfers. The entire buffer must be
    copied, not just the first actual_length bytes, because the individual
    packets will be discontiguous if any of them are short.

    Reported-by: Markus Rechberger <mrechberger@gmail.com>
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/core/devio.c | 17 ++++++++++++++---
    1 file changed, 14 insertions(+), 3 deletions(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -1176,6 +1176,13 @@ static int proc_do_submiturb(struct dev_
    free_async(as);
    return -ENOMEM;
    }
    + /* Isochronous input data may end up being discontiguous
    + * if some of the packets are short. Clear the buffer so
    + * that the gaps don't leak kernel data to userspace.
    + */
    + if (is_in && uurb->type == USBDEVFS_URB_TYPE_ISO)
    + memset(as->urb->transfer_buffer, 0,
    + uurb->buffer_length);
    }
    as->urb->dev = ps->dev;
    as->urb->pipe = (uurb->type << 30) |
    @@ -1312,10 +1319,14 @@ static int processcompl(struct async *as
    void __user *addr = as->userurb;
    unsigned int i;

    - if (as->userbuffer && urb->actual_length)
    - if (copy_to_user(as->userbuffer, urb->transfer_buffer,
    - urb->actual_length))
    + if (as->userbuffer && urb->actual_length) {
    + if (urb->number_of_packets > 0) /* Isochronous */
    + i = urb->transfer_buffer_length;
    + else /* Non-Isoc */
    + i = urb->actual_length;
    + if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
    goto err_out;
    + }
    if (put_user(as->status, &userurb->status))
    goto err_out;
    if (put_user(urb->actual_length, &userurb->actual_length))



    \
     
     \ /
      Last update: 2010-03-31 02:09    [W:2.144 / U:0.288 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site