[PATCH] usb: gadget: return the right length in ffs_epfile_io()

[PATCH] usb: gadget: return the right length in ffs_epfile_io()

[Chuansheng Liu]

When the request length is aligned to maxpacketsize, sometimes
the return length ret > the user space requested len.

At that time, we will use min_t(size_t, ret, len) to limit the
size in case of user data buffer overflow.

But we need return the min_t(size_t, ret, len) to tell the user
space rightly also.

Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
---
 drivers/usb/gadget/f_fs.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 2b43343..31ee7af 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -687,10 +687,12 @@ static ssize_t ffs_epfile_io(struct file *file,
 			 * space for.
 			 */
 			ret = ep->status;
-			if (read && ret > 0 &&
-			    unlikely(copy_to_user(buf, data,
-						  min_t(size_t, ret, len))))
-				ret = -EFAULT;
+			if (read && ret > 0) {
+				ret = min_t(size_t, ret, len);
+
+				if (unlikely(copy_to_user(buf, data, ret)))
+					ret = -EFAULT;
+			}
 		}
 	}
 
-- 
1.9.rc0

Re: [PATCH] usb: gadget: return the right length in ffs_epfile_io()

[Michal Nazarewicz]

[-- Attachment #1: Type: text/plain, Size: 1535 bytes --]

On Thu, Feb 27 2014, Chuansheng Liu <chuansheng.liu@intel.com> wrote:
> When the request length is aligned to maxpacketsize, sometimes
> the return length ret > the user space requested len.
>
> At that time, we will use min_t(size_t, ret, len) to limit the
> size in case of user data buffer overflow.
>
> But we need return the min_t(size_t, ret, len) to tell the user
> space rightly also.
>
> Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>

Acked-by: Michal Nazarewicz <mina86@mina86.com>

> ---
>  drivers/usb/gadget/f_fs.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
> index 2b43343..31ee7af 100644
> --- a/drivers/usb/gadget/f_fs.c
> +++ b/drivers/usb/gadget/f_fs.c
> @@ -687,10 +687,12 @@ static ssize_t ffs_epfile_io(struct file *file,
>  			 * space for.
>  			 */
>  			ret = ep->status;
> -			if (read && ret > 0 &&
> -			    unlikely(copy_to_user(buf, data,
> -						  min_t(size_t, ret, len))))
> -				ret = -EFAULT;
> +			if (read && ret > 0) {
> +				ret = min_t(size_t, ret, len);
> +
> +				if (unlikely(copy_to_user(buf, data, ret)))
> +					ret = -EFAULT;
> +			}
>  		}
>  	}
>  
> -- 
> 1.9.rc0
>

-- 
Best regards,                                         _     _
.o. | Liege of Serenely Enlightened Majesty of      o' \,=./ `o
..o | Computer Science,  Michał “mina86” Nazarewicz    (o o)
ooo +--<mpn@google.com>--<xmpp:mina86@jabber.org>--ooO--(_)--Ooo--

[-- Attachment #2.1: Type: text/plain, Size: 0 bytes --]



[-- Attachment #2.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 835 bytes --]

Re: [PATCH] usb: gadget: return the right length in ffs_epfile_io()

[David Cohen]

On Thu, Feb 27, 2014 at 01:15:25PM +0100, Michal Nazarewicz wrote:
> On Thu, Feb 27 2014, Chuansheng Liu <chuansheng.liu@intel.com> wrote:
> > When the request length is aligned to maxpacketsize, sometimes
> > the return length ret > the user space requested len.
> >
> > At that time, we will use min_t(size_t, ret, len) to limit the
> > size in case of user data buffer overflow.
> >
> > But we need return the min_t(size_t, ret, len) to tell the user
> > space rightly also.
> >
> > Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
> 
> Acked-by: Michal Nazarewicz <mina86@mina86.com>

Reviewed-by: David Cohen <david.a.cohen@linux.intel.com>

IMHO it makes sense to push this patch to 3.14-rc since it is an
extension of usb gadget's quick_ep_out_aligned_size merged on 3.14-rc1

Br, David Cohen

Re: [PATCH] usb: gadget: return the right length in ffs_epfile_io()

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 1235 bytes --]

Hi,

On Thu, Feb 27, 2014 at 02:49:31PM +0800, Chuansheng Liu wrote:
> When the request length is aligned to maxpacketsize, sometimes
> the return length ret > the user space requested len.
> 
> At that time, we will use min_t(size_t, ret, len) to limit the
> size in case of user data buffer overflow.
> 
> But we need return the min_t(size_t, ret, len) to tell the user
> space rightly also.
> 
> Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>
> ---
>  drivers/usb/gadget/f_fs.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
> index 2b43343..31ee7af 100644
> --- a/drivers/usb/gadget/f_fs.c
> +++ b/drivers/usb/gadget/f_fs.c
> @@ -687,10 +687,12 @@ static ssize_t ffs_epfile_io(struct file *file,
>  			 * space for.
>  			 */
>  			ret = ep->status;
> -			if (read && ret > 0 &&
> -			    unlikely(copy_to_user(buf, data,
> -						  min_t(size_t, ret, len))))
> -				ret = -EFAULT;
> +			if (read && ret > 0) {
> +				ret = min_t(size_t, ret, len);
> +
> +				if (unlikely(copy_to_user(buf, data, ret)))
> +					ret = -EFAULT;
> +			}

please rebase on my "testing/next" branch

-- 
balbi

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

RE: [PATCH] usb: gadget: return the right length in ffs_epfile_io()

[Liu, Chuansheng]

Hello Balbi,

> -----Original Message-----
> From: Felipe Balbi [mailto:balbi@ti.com]
> Sent: Tuesday, March 04, 2014 12:30 AM
> To: Liu, Chuansheng
> Cc: balbi@ti.com; gregkh@linuxfoundation.org; mina86@mina86.com;
> linux-usb@vger.kernel.org; linux-kernel@vger.kernel.org; Cohen, David A;
> Zhuang, Jin Can; Wang, Yu Y
> Subject: Re: [PATCH] usb: gadget: return the right length in ffs_epfile_io()
> 
> Hi,
> 
> On Thu, Feb 27, 2014 at 02:49:31PM +0800, Chuansheng Liu wrote:
> > When the request length is aligned to maxpacketsize, sometimes
> > the return length ret > the user space requested len.
> >
> > At that time, we will use min_t(size_t, ret, len) to limit the
> > size in case of user data buffer overflow.
> >
> > But we need return the min_t(size_t, ret, len) to tell the user
> > space rightly also.
> >
> > Signed-off-by: Chuansheng Liu <chuansheng.liu@intel.com>

> please rebase on my "testing/next" branch

Based on your branch "testing/next", I have sent patch v2 with some ack
and reviewing, thanks.

[PATCH v2] usb: gadget: return the right length in ffs_epfile_io()


Best Regards
Chuansheng