From: Alan Stern <stern@rowland.harvard.edu>
To: Henrik Rydberg <rydberg@euromail.se>
Cc: Hans de Goede <hdegoede@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
<linux-usb@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
Peter Stuge <peter@stuge.se>
Subject: Re: REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers
Date: Fri, 12 Oct 2012 10:25:23 -0400 (EDT) [thread overview]
Message-ID: <Pine.LNX.4.44L0.1210121018390.1605-100000@iolanthe.rowland.org> (raw)
In-Reply-To: <20121011213707.GA2187@polaris.bitmath.org>
On Thu, 11 Oct 2012, Henrik Rydberg wrote:
> From 40b70394747eea51fdd07cc8213dd6afd24b1b30 Mon Sep 17 00:00:00 2001
> From: Henrik Rydberg <rydberg@euromail.se>
> Date: Thu, 11 Oct 2012 23:27:04 +0200
> Subject: [PATCH] usbdevfs: Fix broken scatter-gather transfer
>
> The recently introduced handling of large bulk transfers is completely
> broken; the same user page is read over and over again. Fixed with
> this patch.
>
> Cc: stable@kernel.org
> Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
> ---
> drivers/usb/core/devio.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
> index ebb8a9d..6e58b59 100644
> --- a/drivers/usb/core/devio.c
> +++ b/drivers/usb/core/devio.c
> @@ -1172,6 +1172,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
> struct usb_ctrlrequest *dr = NULL;
> unsigned int u, totlen, isofrmlen;
> int i, ret, is_in, num_sgs = 0, ifnum = -1;
> + void __user *userbuf;
> void *buf;
>
> if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
> @@ -1333,6 +1334,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
> as->urb->num_sgs = num_sgs;
> sg_init_table(as->urb->sg, as->urb->num_sgs);
>
> + userbuf = uurb->buffer;
> totlen = uurb->buffer_length;
> for (i = 0; i < as->urb->num_sgs; i++) {
> u = (totlen > USB_SG_SIZE) ? USB_SG_SIZE : totlen;
> @@ -1344,11 +1346,12 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
> sg_set_buf(&as->urb->sg[i], buf, u);
>
> if (!is_in) {
> - if (copy_from_user(buf, uurb->buffer, u)) {
> + if (copy_from_user(buf, userbuf, u)) {
> ret = -EFAULT;
> goto error;
> }
> }
> + userbuf += u;
Instead of introducing a new local variable, why not simply update
uurb->buffer? That's what we do elsewhere in the code.
Alan Stern
next prev parent reply other threads:[~2012-10-12 14:25 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-10 20:31 REGRESSION: usbdevfs: Use-scatter-gather-lists-for-large-bulk-transfers Henrik Rydberg
2012-10-10 20:34 ` Peter Stuge
2012-10-11 5:44 ` Henrik Rydberg
2012-10-11 6:50 ` Peter Stuge
2012-10-11 6:57 ` Xiaofan Chen
2012-10-11 7:12 ` Peter Stuge
2012-10-11 21:54 ` Henrik Rydberg
2012-10-11 8:21 ` Hans de Goede
2012-10-11 21:37 ` Henrik Rydberg
2012-10-11 21:40 ` Peter Stuge
2012-10-11 21:53 ` Greg Kroah-Hartman
2012-10-12 14:11 ` Hans de Goede
2012-10-12 15:10 ` Henrik Rydberg
2012-10-12 14:25 ` Alan Stern [this message]
2012-10-12 15:08 ` Henrik Rydberg
2012-10-12 15:10 ` Alan Stern
2012-10-14 15:40 ` Hans de Goede
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.44L0.1210121018390.1605-100000@iolanthe.rowland.org \
--to=stern@rowland.harvard.edu \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=peter@stuge.se \
--cc=rydberg@euromail.se \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).