From: "Dingyan Li" <18500469033@163.com>
To: "Oliver Neukum" <oneukum@suse.com>
Cc: "Greg KH" <gregkh@linuxfoundation.org>,
stern@rowland.harvard.edu, sebastian.reichel@collabora.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re:Re: [PATCH] USB: add usbfs ioctl to get specific superspeedplus rates
Date: Wed, 26 Jul 2023 17:36:38 +0800 (CST) [thread overview]
Message-ID: <3a822c60.6ae8.189918ebd0a.Coremail.18500469033@163.com> (raw)
In-Reply-To: <37ae1c44-fe7e-3f0f-0eea-0c684fe04d50@suse.com>
At 2023-07-26 16:33:22, "Oliver Neukum" <oneukum@suse.com> wrote:
>On 25.07.23 18:11, Dingyan Li wrote:
>
>> In proc_conninfo_ex(), the number of returned bytes is determined by
>> the smaller number between sizeof(struct usbdevfs_conninfo_ex) and a
>> user specified size. So if we only append new members to the end of
>> struct usbdevfs_conninfo_ex, it won't impact the bytes in the beginning.
>
>You have just caused memory corruption in user space by overwriting what
>was right behind the buffer of the agreed upon size. Or, not much better,
>caused a segmentation fault.
>
> Regards
> Oliver
How come?
The actual returned bytes must be smaller than or equal to user specified size.
You can check https://elixir.bootlin.com/linux/v6.5-rc3/source/drivers/usb/core/devio.c#L1493
Regards,
Dingyan
next prev parent reply other threads:[~2023-07-26 9:38 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-21 8:40 Dingyan Li
2023-07-21 11:04 ` Greg KH
[not found] ` <550dbb46.5bc4.189785b0360.Coremail.18500469033@163.com>
2023-07-21 12:11 ` Greg KH
2023-07-21 12:35 ` Dingyan Li
2023-07-21 14:51 ` Greg KH
2023-07-21 15:43 ` Dingyan Li
2023-07-21 17:26 ` Alan Stern
2023-07-24 9:47 ` Oliver Neukum
2023-07-25 13:24 ` Greg KH
2023-07-25 13:54 ` Dingyan Li
2023-07-25 14:08 ` Oliver Neukum
2023-07-25 14:40 ` Dingyan Li
2023-07-25 15:12 ` Greg KH
2023-07-25 16:11 ` Dingyan Li
2023-07-26 8:33 ` Oliver Neukum
2023-07-26 9:36 ` Dingyan Li [this message]
2023-07-26 9:49 ` Oliver Neukum
2023-07-26 10:10 ` Dingyan Li
2023-07-26 1:37 ` Xiaofan Chen
2023-07-26 9:38 ` Oliver Neukum
2023-07-26 3:20 ` Xiaofan Chen
2023-07-26 14:39 ` Hans de Goede
2023-08-03 6:13 ` Dingyan Li
2023-08-03 15:10 ` Alan Stern
2023-08-03 15:39 ` Hans de Goede
2023-08-03 16:06 ` Dingyan Li
2023-08-03 17:56 ` Alan Stern
2023-08-04 4:16 ` Dingyan Li
2023-08-04 14:55 ` Alan Stern
2023-08-19 4:32 ` Dingyan Li
2023-08-19 5:46 ` [PATCH v2] USB: Support 20Gbps speed for ioctl USBDEVFS_GET_SPEED Dingyan Li
2023-08-19 19:03 ` Alan Stern
2023-08-20 5:29 ` Dingyan Li
2023-08-19 18:46 ` Re: Re: Re: [PATCH] USB: add usbfs ioctl to get specific superspeedplus rates Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3a822c60.6ae8.189918ebd0a.Coremail.18500469033@163.com \
--to=18500469033@163.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=sebastian.reichel@collabora.com \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®