Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Roel Kluin <roel.kluin@gmail.com>]

After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
break occurred, i equals config->desc.bNumInterfaces. so if
usb_control_msg() failed then after goto reset_old_alts we read from
config->interface[config->desc.bNumInterfaces].

Reported-by: "Juha Leppanen" <juha_motorsportcom@luukku.com>
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---

>> You correctly identified a problem, but your fix is wrong -- or at 
>> least, it is much too complicated. The proper fix goes like this:
> 
>  	/* If not, reinstate the old alternate settings */
>  	if (retval < 0) {
>  reset_old_alts:
> -		for (; i >= 0; i--) {
> +		for (i--; i >= 0; i--) {
>  			struct usb_interface *intf = config->interface[i];
>  			struct usb_host_interface *alt;


Are you really sure this is better? If usb_hcd_alloc_bandwidth() fails,
in the loop _before_ the reset_old_alts label, don't we still have to
reinstate the old alternate settings for that usb_interface
config->interface[i]? This was what my initial patch tried to do.

Alternatively usb_hcd_alloc_bandwidth() could undo what it does if an
error occurs there, then I think i could be decremented.

IOW isn't this the proper fix?

Roel

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9bc95fe..4327eab 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1489,8 +1489,10 @@ reset_old_alts:
 			USB_REQ_SET_CONFIGURATION, 0,
 			config->desc.bConfigurationValue, 0,
 			NULL, 0, USB_CTRL_SET_TIMEOUT);
-	if (retval < 0)
+	if (retval < 0) {
+		i--;
 		goto reset_old_alts;
+	}
 	mutex_unlock(&hcd->bandwidth_mutex);
 
 	/* re-init hc/hcd interface/endpoint state */