[PATCH] USB speedtouch: discard packets for non-existant vcc's

[PATCH] USB speedtouch: discard packets for non-existant vcc's

[Duncan Sands]

[-- Attachment #1: Type: text/plain, Size: 1151 bytes --]

I broke part of the udsl_decode_rawcell logic in a previous patch, leading to
possible hangs on startup/shutdown.  I've attached the 2.4 and 2.5 versions.
Thanks to Subodh Srivastava and Ted Phelps for their bug reports.  Here is the
2.5 patch included inline for reference:

--- redux-2.5/drivers/usb/misc/speedtch.c	2003-04-12 11:29:03.000000000 +0200
+++ bollux-2.5/drivers/usb/misc/speedtch.c	2003-04-12 13:35:57.000000000 +0200
@@ -278,9 +278,10 @@
 
 		/* here should the header CRC check be... */
 
-		if (!(vcc = udsl_find_vcc (instance, vpi, vci)))
+		if (!(vcc = udsl_find_vcc (instance, vpi, vci))) {
 			dbg ("udsl_decode_rawcell: no vcc found for packet on vpi %d, vci %d", vpi, vci);
-		else {
+			__skb_pull (skb, min (skb->len, (unsigned) 53));
+		} else {
 			dbg ("udsl_decode_rawcell found vcc %p for packet on vpi %d, vci %d", vcc, vpi, vci);
 
 			if (skb->len >= 53) {
@@ -323,8 +324,8 @@
 				skb_pull (skb, 53);
 			} else {
 				/* If data is corrupt and skb doesn't hold a whole cell, flush the lot */
-				if (skb_pull (skb, 53) == NULL)
-					return NULL;
+				__skb_pull (skb, skb->len);
+				return NULL;
 			}
 		}
 	}


[-- Attachment #2: patch-2.4.diff --]
[-- Type: text/x-diff, Size: 868 bytes --]

--- redux-2.4/drivers/usb/speedtouch.c	2003-04-12 11:23:46.000000000 +0200
+++ bollux-2.4/drivers/usb/speedtouch.c	2003-04-12 11:19:25.000000000 +0200
@@ -278,9 +278,10 @@
 
 		/* here should the header CRC check be... */
 
-		if (!(vcc = udsl_find_vcc (instance, vpi, vci)))
+		if (!(vcc = udsl_find_vcc (instance, vpi, vci))) {
 			dbg ("udsl_decode_rawcell: no vcc found for packet on vpi %d, vci %d", vpi, vci);
-		else {
+			__skb_pull (skb, min (skb->len, (unsigned) 53));
+		} else {
 			dbg ("udsl_decode_rawcell found vcc %p for packet on vpi %d, vci %d", vcc, vpi, vci);
 
 			if (skb->len >= 53) {
@@ -323,8 +324,8 @@
 				skb_pull (skb, 53);
 			} else {
 				/* If data is corrupt and skb doesn't hold a whole cell, flush the lot */
-				if (skb_pull (skb, 53) == NULL)
-					return NULL;
+				__skb_pull (skb, skb->len);
+				return NULL;
 			}
 		}
 	}

[-- Attachment #3: patch-2.5.diff --]
[-- Type: text/x-diff, Size: 874 bytes --]

--- redux-2.5/drivers/usb/misc/speedtch.c	2003-04-12 11:29:03.000000000 +0200
+++ bollux-2.5/drivers/usb/misc/speedtch.c	2003-04-12 13:35:57.000000000 +0200
@@ -278,9 +278,10 @@
 
 		/* here should the header CRC check be... */
 
-		if (!(vcc = udsl_find_vcc (instance, vpi, vci)))
+		if (!(vcc = udsl_find_vcc (instance, vpi, vci))) {
 			dbg ("udsl_decode_rawcell: no vcc found for packet on vpi %d, vci %d", vpi, vci);
-		else {
+			__skb_pull (skb, min (skb->len, (unsigned) 53));
+		} else {
 			dbg ("udsl_decode_rawcell found vcc %p for packet on vpi %d, vci %d", vcc, vpi, vci);
 
 			if (skb->len >= 53) {
@@ -323,8 +324,8 @@
 				skb_pull (skb, 53);
 			} else {
 				/* If data is corrupt and skb doesn't hold a whole cell, flush the lot */
-				if (skb_pull (skb, 53) == NULL)
-					return NULL;
+				__skb_pull (skb, skb->len);
+				return NULL;
 			}
 		}
 	}

Re: [PATCH] USB speedtouch: discard packets for non-existant vcc's

[Greg KH]

On Sat, Apr 12, 2003 at 01:49:39PM +0200, Duncan Sands wrote:
> I broke part of the udsl_decode_rawcell logic in a previous patch, leading to
> possible hangs on startup/shutdown.  I've attached the 2.4 and 2.5 versions.
> Thanks to Subodh Srivastava and Ted Phelps for their bug reports.  Here is the
> 2.5 patch included inline for reference:

Applied to my 2.4 and 2.5 trees, thanks.

greg k-h