Linux-USB Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] NFC: pn533: fix bulk-message timeout
@ 2020-01-13 17:23 Johan Hovold
  2020-01-13 18:25 ` Greg Kroah-Hartman
  2020-01-14  2:56 ` Jakub Kicinski
  0 siblings, 2 replies; 3+ messages in thread
From: Johan Hovold @ 2020-01-13 17:23 UTC (permalink / raw)
  To: netdev; +Cc: linux-usb, linux-kernel, Johan Hovold, stable, Greg Kroah-Hartman

The driver was doing a synchronous uninterruptible bulk-transfer without
using a timeout. This could lead to the driver hanging on probe due to a
malfunctioning (or malicious) device until the device is physically
disconnected. While sleeping in probe the driver prevents other devices
connected to the same hub from being added to (or removed from) the bus.

An arbitrary limit of five seconds should be more than enough.

Fixes: dbafc28955fa ("NFC: pn533: don't send USB data off of the stack")
Cc: stable <stable@vger.kernel.org>     # 4.18
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/nfc/pn533/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c
index 4590fbf82dc2..f5bb7ace2ff5 100644
--- a/drivers/nfc/pn533/usb.c
+++ b/drivers/nfc/pn533/usb.c
@@ -391,7 +391,7 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy)
 		       cmd, sizeof(cmd), false);
 
 	rc = usb_bulk_msg(phy->udev, phy->out_urb->pipe, buffer, sizeof(cmd),
-			  &transferred, 0);
+			  &transferred, 5000);
 	kfree(buffer);
 	if (rc || (transferred != sizeof(cmd))) {
 		nfc_err(&phy->udev->dev,
-- 
2.24.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] NFC: pn533: fix bulk-message timeout
  2020-01-13 17:23 [PATCH] NFC: pn533: fix bulk-message timeout Johan Hovold
@ 2020-01-13 18:25 ` Greg Kroah-Hartman
  2020-01-14  2:56 ` Jakub Kicinski
  1 sibling, 0 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2020-01-13 18:25 UTC (permalink / raw)
  To: Johan Hovold; +Cc: netdev, linux-usb, linux-kernel, stable

On Mon, Jan 13, 2020 at 06:23:58PM +0100, Johan Hovold wrote:
> The driver was doing a synchronous uninterruptible bulk-transfer without
> using a timeout. This could lead to the driver hanging on probe due to a
> malfunctioning (or malicious) device until the device is physically
> disconnected. While sleeping in probe the driver prevents other devices
> connected to the same hub from being added to (or removed from) the bus.
> 
> An arbitrary limit of five seconds should be more than enough.
> 
> Fixes: dbafc28955fa ("NFC: pn533: don't send USB data off of the stack")
> Cc: stable <stable@vger.kernel.org>     # 4.18
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/nfc/pn533/usb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)


Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] NFC: pn533: fix bulk-message timeout
  2020-01-13 17:23 [PATCH] NFC: pn533: fix bulk-message timeout Johan Hovold
  2020-01-13 18:25 ` Greg Kroah-Hartman
@ 2020-01-14  2:56 ` Jakub Kicinski
  1 sibling, 0 replies; 3+ messages in thread
From: Jakub Kicinski @ 2020-01-14  2:56 UTC (permalink / raw)
  To: Johan Hovold; +Cc: netdev, linux-usb, linux-kernel, stable, Greg Kroah-Hartman

On Mon, 13 Jan 2020 18:23:58 +0100, Johan Hovold wrote:
> The driver was doing a synchronous uninterruptible bulk-transfer without
> using a timeout. This could lead to the driver hanging on probe due to a
> malfunctioning (or malicious) device until the device is physically
> disconnected. While sleeping in probe the driver prevents other devices
> connected to the same hub from being added to (or removed from) the bus.
> 
> An arbitrary limit of five seconds should be more than enough.
> 
> Fixes: dbafc28955fa ("NFC: pn533: don't send USB data off of the stack")
> Cc: stable <stable@vger.kernel.org>     # 4.18
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>

Applied to net, thank you. In the future please don't CC stable
explicitly on networking patches, Dave (or I) will select and send
all relevant patches to stable as noted in netdev FAQ.

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-13 17:23 [PATCH] NFC: pn533: fix bulk-message timeout Johan Hovold
2020-01-13 18:25 ` Greg Kroah-Hartman
2020-01-14  2:56 ` Jakub Kicinski

Linux-USB Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-usb/0 linux-usb/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-usb linux-usb/ https://lore.kernel.org/linux-usb \
		linux-usb@vger.kernel.org
	public-inbox-index linux-usb

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-usb


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git