[PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Roel Kluin]

After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
break occurred, i equals config->desc.bNumInterfaces. so if
usb_control_msg() failed then after goto reset_old_alts we read from
config->interface[config->desc.bNumInterfaces].

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9bc95fe..00b49bc 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1466,10 +1466,15 @@ int usb_reset_configuration(struct usb_device *dev)
 			retval = usb_hcd_alloc_bandwidth(dev, NULL,
 					intf->cur_altsetting, alt);
 		if (retval < 0)
-			break;
+			/* If not, reinstate the old alternate settings */
+			goto reset_old_alts;
 	}
-	/* If not, reinstate the old alternate settings */
+	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+			USB_REQ_SET_CONFIGURATION, 0,
+			config->desc.bConfigurationValue, 0,
+			NULL, 0, USB_CTRL_SET_TIMEOUT);
 	if (retval < 0) {
+		i--;
 reset_old_alts:
 		for (; i >= 0; i--) {
 			struct usb_interface *intf = config->interface[i];
@@ -1485,12 +1490,6 @@ reset_old_alts:
 		mutex_unlock(&hcd->bandwidth_mutex);
 		return retval;
 	}
-	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-			USB_REQ_SET_CONFIGURATION, 0,
-			config->desc.bConfigurationValue, 0,
-			NULL, 0, USB_CTRL_SET_TIMEOUT);
-	if (retval < 0)
-		goto reset_old_alts;
 	mutex_unlock(&hcd->bandwidth_mutex);
 
 	/* re-init hc/hcd interface/endpoint state */

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Greg KH]

On Tue, Feb 09, 2010 at 02:00:05PM +0100, Roel Kluin wrote:
> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
> break occurred, i equals config->desc.bNumInterfaces. so if
> usb_control_msg() failed then after goto reset_old_alts we read from
> config->interface[config->desc.bNumInterfaces].
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>

Have you seen this happen on real hardware?

curious,

greg k-h

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[roel kluin]

On Tue, Feb 9, 2010 at 2:08 PM, Greg KH <gregkh@suse.de> wrote:
> On Tue, Feb 09, 2010 at 02:00:05PM +0100, Roel Kluin wrote:
>> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
>> break occurred, i equals config->desc.bNumInterfaces. so if
>> usb_control_msg() failed then after goto reset_old_alts we read from
>> config->interface[config->desc.bNumInterfaces].
>>
>> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
>
> Have you seen this happen on real hardware?
>
> curious,
>
> greg k-h
>

No, I just found it in the code,

Thanks, Roel

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Alan Stern]

On Tue, 9 Feb 2010, Roel Kluin wrote:

> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
> break occurred, i equals config->desc.bNumInterfaces. so if
> usb_control_msg() failed then after goto reset_old_alts we read from
> config->interface[config->desc.bNumInterfaces].

You correctly identified a problem, but your fix is wrong -- or at 
least, it is much too complicated.  The proper fix goes like this:

 	/* If not, reinstate the old alternate settings */
 	if (retval < 0) {
 reset_old_alts:
-		for (; i >= 0; i--) {
+		for (i--; i >= 0; i--) {
 			struct usb_interface *intf = config->interface[i];
 			struct usb_host_interface *alt;
 

Alan Stern

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Roel Kluin]

After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
break occurred, i equals config->desc.bNumInterfaces. so if
usb_control_msg() failed then after goto reset_old_alts we read from
config->interface[config->desc.bNumInterfaces].
We can safely decrement i as well if the break occurred.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
---

> You correctly identified a problem, but your fix is wrong -- or at 
> least, it is much too complicated.

Ok,

 drivers/usb/core/message.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9bc95fe..1a48aac 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1471,7 +1471,7 @@ int usb_reset_configuration(struct usb_device *dev)
 	/* If not, reinstate the old alternate settings */
 	if (retval < 0) {
 reset_old_alts:
-		for (; i >= 0; i--) {
+		for (i--; i >= 0; i--) {
 			struct usb_interface *intf = config->interface[i];
 			struct usb_host_interface *alt;
 

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Sarah Sharp]

On Tue, Feb 09, 2010 at 05:01:53PM +0100, Roel Kluin wrote:
> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
> break occurred, i equals config->desc.bNumInterfaces. so if
> usb_control_msg() failed then after goto reset_old_alts we read from
> config->interface[config->desc.bNumInterfaces].
> We can safely decrement i as well if the break occurred.
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> Acked-by: Alan Stern <stern@rowland.harvard.edu>

Bah, yes, you're right. :)  Good catch.

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>

> ---
> 
> > You correctly identified a problem, but your fix is wrong -- or at 
> > least, it is much too complicated.
> 
> Ok,
> 
>  drivers/usb/core/message.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
> index 9bc95fe..1a48aac 100644
> --- a/drivers/usb/core/message.c
> +++ b/drivers/usb/core/message.c
> @@ -1471,7 +1471,7 @@ int usb_reset_configuration(struct usb_device *dev)
>  	/* If not, reinstate the old alternate settings */
>  	if (retval < 0) {
>  reset_old_alts:
> -		for (; i >= 0; i--) {
> +		for (i--; i >= 0; i--) {
>  			struct usb_interface *intf = config->interface[i];
>  			struct usb_host_interface *alt;
>  
> --
> To unsubscribe from this list: send the line "unsubscribe linux-usb" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Roel Kluin]

After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
break occurred, i equals config->desc.bNumInterfaces. so if
usb_control_msg() failed then after goto reset_old_alts we read from
config->interface[config->desc.bNumInterfaces].

Reported-by: "Juha Leppanen" <juha_motorsportcom@luukku.com>
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---

>> You correctly identified a problem, but your fix is wrong -- or at 
>> least, it is much too complicated. The proper fix goes like this:
> 
>  	/* If not, reinstate the old alternate settings */
>  	if (retval < 0) {
>  reset_old_alts:
> -		for (; i >= 0; i--) {
> +		for (i--; i >= 0; i--) {
>  			struct usb_interface *intf = config->interface[i];
>  			struct usb_host_interface *alt;


Are you really sure this is better? If usb_hcd_alloc_bandwidth() fails,
in the loop _before_ the reset_old_alts label, don't we still have to
reinstate the old alternate settings for that usb_interface
config->interface[i]? This was what my initial patch tried to do.

Alternatively usb_hcd_alloc_bandwidth() could undo what it does if an
error occurs there, then I think i could be decremented.

IOW isn't this the proper fix?

Roel

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9bc95fe..4327eab 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1489,8 +1489,10 @@ reset_old_alts:
 			USB_REQ_SET_CONFIGURATION, 0,
 			config->desc.bConfigurationValue, 0,
 			NULL, 0, USB_CTRL_SET_TIMEOUT);
-	if (retval < 0)
+	if (retval < 0) {
+		i--;
 		goto reset_old_alts;
+	}
 	mutex_unlock(&hcd->bandwidth_mutex);
 
 	/* re-init hc/hcd interface/endpoint state */

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[roel kluin]

On Tue, Feb 9, 2010 at 11:01 PM, Sarah Sharp
<sarah.a.sharp@linux.intel.com> wrote:
> On Tue, Feb 09, 2010 at 05:01:53PM +0100, Roel Kluin wrote:
>> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
>> break occurred, i equals config->desc.bNumInterfaces. so if
>> usb_control_msg() failed then after goto reset_old_alts we read from
>> config->interface[config->desc.bNumInterfaces].
>> We can safely decrement i as well if the break occurred.
>>
>> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
>> Acked-by: Alan Stern <stern@rowland.harvard.edu>
>
> Bah, yes, you're right. :)  Good catch.

Could you please confirm whether this patch is the better or the
other (in this same thread)?

Thanks,
Roel

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Sarah Sharp]

On Tue, Feb 09, 2010 at 11:01:24PM +0100, Roel Kluin wrote:
> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
> break occurred, i equals config->desc.bNumInterfaces. so if
> usb_control_msg() failed then after goto reset_old_alts we read from
> config->interface[config->desc.bNumInterfaces].
> 
> Reported-by: "Juha Leppanen" <juha_motorsportcom@luukku.com>
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> ---
> 
> >> You correctly identified a problem, but your fix is wrong -- or at 
> >> least, it is much too complicated. The proper fix goes like this:
> > 
> >  	/* If not, reinstate the old alternate settings */
> >  	if (retval < 0) {
> >  reset_old_alts:
> > -		for (; i >= 0; i--) {
> > +		for (i--; i >= 0; i--) {
> >  			struct usb_interface *intf = config->interface[i];
> >  			struct usb_host_interface *alt;
> 
> 
> Are you really sure this is better?

Yes.

> If usb_hcd_alloc_bandwidth() fails, in the loop _before_ the
> reset_old_alts label, don't we still have to reinstate the old
> alternate settings for that usb_interface config->interface[i]? This
> was what my initial patch tried to do.

No, you do not.  Take a look at usb_hcd_alloc_bandwidth() in
drivers/usb/core/hcd.c.  If an allocation fails for interface i when
the HCD's check_bandwidth() function is called, then
hcd->driver->reset_bandwidth is called.  We only need to clean up the
interfaces that have successfully been allocated bandwidth (0 to i - 1).

> Alternatively usb_hcd_alloc_bandwidth() could undo what it does if an
> error occurs there, then I think i could be decremented.

Yes, that's what usb_hcd_alloc_bandwidth() does at the reset label.

Sarah

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Greg KH]

On Tue, Feb 09, 2010 at 11:09:45PM +0100, roel kluin wrote:
> On Tue, Feb 9, 2010 at 11:01 PM, Sarah Sharp
> <sarah.a.sharp@linux.intel.com> wrote:
> > On Tue, Feb 09, 2010 at 05:01:53PM +0100, Roel Kluin wrote:
> >> After the loop `for (i = 0; i < config->desc.bNumInterfaces; i++)' if no
> >> break occurred, i equals config->desc.bNumInterfaces. so if
> >> usb_control_msg() failed then after goto reset_old_alts we read from
> >> config->interface[config->desc.bNumInterfaces].
> >> We can safely decrement i as well if the break occurred.
> >>
> >> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
> >> Acked-by: Alan Stern <stern@rowland.harvard.edu>
> >
> > Bah, yes, you're right. :)  Good catch.
> 
> Could you please confirm whether this patch is the better or the
> other (in this same thread)?

Can someone tell me which one is the correct one to apply, but resending
it to me?

thanks,

greg k-h

Re: [PATCH] USB: don't read past config->interface[] if usb_control_msg() fails in usb_reset_configuration()

[Roel Kluin]

While looping over the interfaces, if usb_hcd_alloc_bandwidth() fails it calls
hcd->driver->reset_bandwidth(), so there was no need to reinstate the interface
again.

If no break occurred, the index equals config->desc.bNumInterfaces. A
subsequent usb_control_msg() failure resulted in a read from
config->interface[config->desc.bNumInterfaces] at label reset_old_alts.

In either case the last interface should be skipped.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
---
>> Could you please confirm whether this patch is the better or the
>> other (in this same thread)?
> 
> Can someone tell me which one is the correct one to apply, but resending
> it to me?

This is the one as Sarah kindly explained to me.

Thanks, Roel

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9bc95fe..1a48aac 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1471,7 +1471,7 @@ int usb_reset_configuration(struct usb_device *dev)
 	/* If not, reinstate the old alternate settings */
 	if (retval < 0) {
 reset_old_alts:
-		for (; i >= 0; i--) {
+		for (i--; i >= 0; i--) {
 			struct usb_interface *intf = config->interface[i];
 			struct usb_host_interface *alt;