From patchwork Wed Mar 24 16:21:52 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Markus Rechberger X-Patchwork-Id: 48437 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 72DC5B7CF0 for ; Thu, 25 Mar 2010 03:22:09 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.69) (envelope-from ) id 1NuTLD-0007CU-Cr; Wed, 24 Mar 2010 16:21:59 +0000 Received: from mail-bw0-f228.google.com ([209.85.218.228]) by chlorine.canonical.com with esmtp (Exim 4.69) (envelope-from ) id 1NuTLB-0007C7-RZ for kernel-team@lists.ubuntu.com; Wed, 24 Mar 2010 16:21:57 +0000 Received: by bwz28 with SMTP id 28so5960216bwz.14 for ; Wed, 24 Mar 2010 09:21:57 -0700 (PDT) MIME-Version: 1.0 Received: by 10.204.18.144 with SMTP id w16mr1742149bka.34.1269447713044; Wed, 24 Mar 2010 09:21:53 -0700 (PDT) Date: Wed, 24 Mar 2010 17:21:52 +0100 Message-ID: Subject: USBFS Bugfix From: Markus Rechberger To: kernel-team@lists.ubuntu.com X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com Hi, on IRC I was recommended to submit this information to the mailinglist https://bugs.launchpad.net/ubuntu/+source/linux/+bug/544527 Here's a better solution. In theory we could copy just the individual packets from within the transfer buffer, but that would probably take longer than simply copying the whole buffer. (This was a little hasty; I haven't even compile-tested the patch. Some small fixes may be needed.) Alan Stern ----------------------------------------------------------------------- This patch fixes a bug in the way isochronous input data is returned to userspace for usbfs transfers. The entire buffer must be copied, not just the first actual_length bytes, because the individual packets will be discontiguous if any of them are short. Signed-off-by: Alan Stern CC: stable --- It would be nice if this patch could go into the ubuntu lucid kernel as soon as possible. Thanks, Markus Index: usb-2.6/drivers/usb/core/devio.c =================================================================== --- usb-2.6.orig/drivers/usb/core/devio.c +++ usb-2.6/drivers/usb/core/devio.c @@ -1176,6 +1176,13 @@ static int proc_do_submiturb(struct dev_ free_async(as); return -ENOMEM; } + /* Isochronous input data may end up being discontiguous + * if some of the packets are short. Clear the buffer so + * that the gaps don't leak kernel data to userspace. + */ + if (is_in && uurb->type == USBDEVFS_URB_TYPE_ISO) + memset(as->urb->transfer_buffer, 0, + uurb->buffer_length); } as->urb->dev = ps->dev; as->urb->pipe = (uurb->type << 30) | @@ -1312,10 +1319,14 @@ static int processcompl(struct async *as void __user *addr = as->userurb; unsigned int i; - if (as->userbuffer && urb->actual_length) - if (copy_to_user(as->userbuffer, urb->transfer_buffer, - urb->actual_length)) + if (as->userbuffer && urb->actual_length) { + if (urb->number_of_packets > 0) /* Isochronous */ + i = urb->transfer_buffer_length; + else /* Non-Isoc */ + i = urb->actual_length; + if (copy_to_user(as->userbuffer, urb->transfer_buffer, i)) goto err_out; + } if (put_user(as->status, &userurb->status)) goto err_out; if (put_user(urb->actual_length, &userurb->actual_length))