| Message ID | tencent_F0CB92D8867509922ED02ED5CCA4E7D2C606@qq.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [V2] wifi: ath6kl: Replace ath6kl_usb_submit_ctrl_in with usb_control_msg_recv | expand |
On 8/25/24 5:21 PM, Edward Adam Davis wrote: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly can fix this warning. > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> [...] > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > index 5220809841a6..dc1f89ebb740 100644 > --- a/drivers/net/wireless/ath/ath6kl/usb.c > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > @@ -1027,9 +1027,9 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) > int ret; > > /* get response */ > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, > - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > - 0, 0, buf, len); ret = usb_control_msg_recv(ar_usb->udev, 0, ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, USB_DIR_IN | USB_TYPE_VENDOR | Strange alignment style... If you're not going to reuse the old style, why this trailing space before USB_DIR_IN? > + USB_RECIP_DEVICE, 0, 0, buf, len, 2000, GFP_KERNEL); Same here... [...] MBR, Sergey
Hello! Oops, sent a wrong draft... :-/ On 8/25/24 5:21 PM, Edward Adam Davis wrote: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly can fix this warning. > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> [...] > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > index 5220809841a6..dc1f89ebb740 100644 > --- a/drivers/net/wireless/ath/ath6kl/usb.c > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > @@ -1027,9 +1027,9 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) > int ret; > > /* get response */ > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, > - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > - 0, 0, buf, len); > + ret = usb_control_msg_recv(ar_usb->udev, 0, ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > + USB_DIR_IN | USB_TYPE_VENDOR | Strange alignment style... If you're not going to reuse the old style, why this trailing space before USB_DIR_IN? > + USB_RECIP_DEVICE, 0, 0, buf, len, 2000, GFP_KERNEL); Same here... [...] MBR, Sergey
On Sun, Aug 25, 2024 at 10:21:49PM +0800, Edward Adam Davis wrote: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly can fix this warning. > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > V2: Directly using USB functions > > drivers/net/wireless/ath/ath6kl/usb.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > index 5220809841a6..dc1f89ebb740 100644 > --- a/drivers/net/wireless/ath/ath6kl/usb.c > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > @@ -1027,9 +1027,9 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) > int ret; > > /* get response */ > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, > - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > - 0, 0, buf, len); By removing this call, there is now only one call left to ath6kl_usb_submit_ctrl_in(), so that probably can also be unwrapped in a second patch in this series, right? > + ret = usb_control_msg_recv(ar_usb->udev, 0, ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > + USB_DIR_IN | USB_TYPE_VENDOR | > + USB_RECIP_DEVICE, 0, 0, buf, len, 2000, GFP_KERNEL); As was pointed out, this is a very odd indentation style. thanks, greg k-h
Hi Greg KH and Sergey, On Mon, 26 Aug 2024 07:04:00 +0200, Greg KH wrote: > > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > > the length of the data read from the device is not equal to the len, and > > such missing judgments will result in subsequent code using incorrect data. > > > > usb_control_msg_recv() handles the abnormal length of the returned data, > > so using it directly can fix this warning. > > > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > > --- > > V2: Directly using USB functions > > > > drivers/net/wireless/ath/ath6kl/usb.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > > index 5220809841a6..dc1f89ebb740 100644 > > --- a/drivers/net/wireless/ath/ath6kl/usb.c > > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > > @@ -1027,9 +1027,9 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) > > int ret; > > > > /* get response */ > > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, > > - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > > - 0, 0, buf, len); > > By removing this call, there is now only one call left to > ath6kl_usb_submit_ctrl_in(), so that probably can also be unwrapped in a > second patch in this series, right? Sorry, I didn't clarify what you said. > > > + ret = usb_control_msg_recv(ar_usb->udev, 0, ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > > + USB_DIR_IN | USB_TYPE_VENDOR | > > + USB_RECIP_DEVICE, 0, 0, buf, len, 2000, GFP_KERNEL); > > As was pointed out, this is a very odd indentation style. I will send V3 patch to adjust the indentation style. BR, Edward
On Mon, Aug 26, 2024 at 07:19:09PM +0800, Edward Adam Davis wrote: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly can fix this warning. > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > V2 -> V3: Adjust indentation style > > drivers/net/wireless/ath/ath6kl/usb.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > index 5220809841a6..5b1ce4f9ed54 100644 > --- a/drivers/net/wireless/ath/ath6kl/usb.c > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > @@ -1027,9 +1027,11 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) > int ret; > > /* get response */ > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, > - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > - 0, 0, buf, len); > + ret = usb_control_msg_recv(ar_usb->udev, 0, > + ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > + USB_DIR_IN | USB_TYPE_VENDOR | > + USB_RECIP_DEVICE, 0, 0, buf, len, 2000, > + GFP_KERNEL); This should be: ret = usb_control_msg_recv(ar_usb->udev, 0, ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, 0, buf, len, 2000, GFP_KERNEL); right? Keep the | values on the same line. thanks, greg k-h
On Mon, Aug 26, 2024 at 07:19:09PM +0800, Edward Adam Davis wrote: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly can fix this warning. > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > V2 -> V3: Adjust indentation style > > drivers/net/wireless/ath/ath6kl/usb.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > index 5220809841a6..5b1ce4f9ed54 100644 > --- a/drivers/net/wireless/ath/ath6kl/usb.c > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > @@ -1027,9 +1027,11 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) > int ret; > > /* get response */ > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, > - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, > - 0, 0, buf, len); Again, please make this a patch series, with the second one removing ath6kl_usb_submit_ctrl_in() and moving to use usb_control_msg_recv() for that too. thanks, greg k-h
Edward Adam Davis <eadavis@qq.com> writes: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly can fix this warning. > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> Did you test this on real ath6kl hardware?
On Mon, 26 Aug 2024 14:42:00 +0300, Kalle Valo wrote: > > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > > the length of the data read from the device is not equal to the len, and > > such missing judgments will result in subsequent code using incorrect data. > > > > usb_control_msg_recv() handles the abnormal length of the returned data, > > so using it directly can fix this warning. > > > > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com > > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > > Did you test this on real ath6kl hardware? I don't have ath6kl hardware, I have only tested it on a virtual machine. BR, Edward
On Mon, Aug 26, 2024 at 08:29:57PM +0800, Edward Adam Davis wrote: > ath6kl_usb_submit_ctrl_in() did not take into account the situation where > the length of the data read from the device is not equal to the len, and > such missing judgments will result in subsequent code using incorrect data. > > usb_control_msg_recv() handles the abnormal length of the returned data, > so using it directly. > > Suggested-by: Greg KH <gregkh@linuxfoundation.org> > Signed-off-by: Edward Adam Davis <eadavis@qq.com> > --- > drivers/net/wireless/ath/ath6kl/usb.c | 39 +++------------------------ > 1 file changed, 3 insertions(+), 36 deletions(-) > > diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c > index 0458b5a078e1..b1fc66d823b8 100644 > --- a/drivers/net/wireless/ath/ath6kl/usb.c > +++ b/drivers/net/wireless/ath/ath6kl/usb.c > @@ -901,40 +901,6 @@ static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb, > return 0; > } > > -static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb, > - u8 req, u16 value, u16 index, void *data, > - u32 size) > -{ > - u8 *buf = NULL; > - int ret; > - > - if (size > 0) { > - buf = kmalloc(size, GFP_KERNEL); > - if (buf == NULL) > - return -ENOMEM; > - } > - > - /* note: if successful returns number of bytes transfered */ > - ret = usb_control_msg(ar_usb->udev, > - usb_rcvctrlpipe(ar_usb->udev, 0), > - req, > - USB_DIR_IN | USB_TYPE_VENDOR | > - USB_RECIP_DEVICE, value, index, buf, > - size, 2000); > - > - if (ret < 0) { > - ath6kl_warn("Failed to read usb control message: %d\n", ret); > - kfree(buf); > - return ret; > - } > - > - memcpy((u8 *) data, buf, size); > - > - kfree(buf); > - > - return 0; > -} > - > static int ath6kl_usb_ctrl_msg_exchange(struct ath6kl_usb *ar_usb, > u8 req_val, u8 *req_buf, u32 req_len, > u8 resp_val, u8 *resp_buf, u32 *resp_len) > @@ -954,8 +920,9 @@ static int ath6kl_usb_ctrl_msg_exchange(struct ath6kl_usb *ar_usb, > } > > /* get response */ > - ret = ath6kl_usb_submit_ctrl_in(ar_usb, resp_val, 0, 0, > - resp_buf, *resp_len); > + ret = usb_control_msg_recv(ar_usb->udev, 0, resp_val, > + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, > + 0, 0, resp_buf, *resp_len, 2000, GFP_KERNEL); You didn't run checkpatch on this :(
Edward Adam Davis <eadavis@qq.com> writes: > On Mon, 26 Aug 2024 14:42:00 +0300, Kalle Valo wrote: >> > ath6kl_usb_submit_ctrl_in() did not take into account the situation where >> > the length of the data read from the device is not equal to the len, and >> > such missing judgments will result in subsequent code using incorrect data. >> > >> > usb_control_msg_recv() handles the abnormal length of the returned data, >> > so using it directly can fix this warning. >> > >> > Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com >> > Signed-off-by: Edward Adam Davis <eadavis@qq.com> >> >> Did you test this on real ath6kl hardware? > > I don't have ath6kl hardware, I have only tested it on a virtual machine. Virtual machine? I guess you mean syzbot? That gives no assurance if this works on a real device or not. Please add to the commit message "Compile tested only" so that we know it's untested. And I have to warn that in wireless we are very reluctant to take syzbot fixes which have not been tested on real hardware, they have caused problems in the past.
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c index 5220809841a6..dc1f89ebb740 100644 --- a/drivers/net/wireless/ath/ath6kl/usb.c +++ b/drivers/net/wireless/ath/ath6kl/usb.c @@ -1027,9 +1027,9 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len) int ret; /* get response */ - ret = ath6kl_usb_submit_ctrl_in(ar_usb, - ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, - 0, 0, buf, len); + ret = usb_control_msg_recv(ar_usb->udev, 0, ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0, 0, buf, len, 2000, GFP_KERNEL); if (ret) { ath6kl_err("Unable to read the bmi data from the device: %d\n", ret);
ath6kl_usb_submit_ctrl_in() did not take into account the situation where the length of the data read from the device is not equal to the len, and such missing judgments will result in subsequent code using incorrect data. usb_control_msg_recv() handles the abnormal length of the returned data, so using it directly can fix this warning. Reported-by: syzbot+92c6dd14aaa230be6855@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- V2: Directly using USB functions drivers/net/wireless/ath/ath6kl/usb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)