From: Pavel Skripkin <paskripkin@gmail.com>
To: "Fabio M. De Francesco" <fmdefrancesco@gmail.com>,
Larry.Finger@lwfinger.net, phil@philpotter.co.uk,
gregkh@linuxfoundation.org, straube.linux@gmail.com
Cc: linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org,
Martin Kaiser <martin@kaiser.cx>
Subject: Re: [PATCH RFC 0/3] staging: r8188eu: avoid uninit value bugs
Date: Sun, 22 Aug 2021 13:09:29 +0300 [thread overview]
Message-ID: <ae27d6a0-dc00-459f-7b36-acf7f4c08d72@gmail.com> (raw)
In-Reply-To: <10584649.zhyk0TxWeL@localhost.localdomain>
On 8/22/21 12:53 PM, Fabio M. De Francesco wrote:
> On Friday, August 20, 2021 7:07:28 PM CEST Pavel Skripkin wrote:
>> Hi, Greg, Larry and Phillip!
>>
>> I noticed, that new staging driver was added like 3 weeks ago and I decided
>> to look at the code, because drivers in staging directory are always buggy.
>>
>> The first thing I noticed is *no one* was checking read operations result,
> but
>> it can fail and driver may start writing random stack values into registers.
> It
>> can cause driver misbehavior or device misbehavior.
>
> After the messages I wrote yesterday, I had some minutes to look deeper at the
> code that would be changed by these patches.
>
> I think that it does not look like that the driver could return "random stack
> values into registers" and I think this entire series in unnecessary.
>
> As far as I understand this driver (though I must admit that I really don't
> know how to write drivers, and I'm not interested in understanding - at the
> moment, at least), all the usb_read*() call usbctrl_vendorreq() and the latter
> *does* proper error checking before returning to the callers the read data.
>
> Please, look at the code copied from usbctrl_vendorreq() and pasted here (some
> comments are mine):
>
> /* start of code */
> static int usbctrl_vendorreq(struct intf_hdl *pintfhdl, u16 value, void
> *pdata, u16 len, u8 requesttype)
> {
>
> /* test if everything is OK for transfers and setup the necessary variables */
> [...]
>
> status = usb_control_msg(udev, pipe, REALTEK_USB_VENQT_CMD_REQ,
> reqtype, value,
> REALTEK_USB_VENQT_CMD_IDX,
> pIo_buf, len,
> RTW_USB_CONTROL_MSG_TIMEOUT);
>
> if (status == len) { /* Success this control transfer. */
> rtw_reset_continual_urb_error(dvobjpriv);
> if (requesttype == 0x01)
> memcpy(pdata, pIo_buf, len); /* pdata
> receives the read data */
> } else { /* error cases */
>
> [...]
>
> }
> /* end of code */
>
> So, *I cannot ack this RFC*, unless maintainers say I'm missing something.
>
> Larry, Philip, since you have much more knowledge than me about r8188eu (and,
> more in general, on device drivers) may you please say what you think about my
> arguments against this series?
>
Hi, Fabio!
Thank you for looking into this, but I still can see the case when pdata
won't be initialized:
pdata is initialized only in case of successful transfer, i.e len > 0.
It means some data was received (maybe not full length, but anyway). In
case of usb_control_msg() error (for example -ENOMEM) code only does
this code block:
if (status < 0) {
if (status == (-ESHUTDOWN) || status == -ENODEV) {
adapt->bSurpriseRemoved = true;
} else {
struct hal_data_8188e *haldata = GET_HAL_DATA(adapt);
haldata->srestpriv.Wifi_Error_Status = USB_VEN_REQ_CMD_FAIL;
}
}
And then just loops further. In case of 10 ENOMEM in a row,. passed
pdata won't be initialized at all and driver doesn't do anything about
it. I believe, it's not good approach to play with random values. We
should somehow handle transfer errors all across the driver.
If I am missing something, please, let me know :)
With regards,
Pavel Skripkin
next prev parent reply other threads:[~2021-08-22 10:09 UTC|newest]
Thread overview: 118+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-20 17:07 [PATCH RFC 0/3] staging: r8188eu: avoid uninit value bugs Pavel Skripkin
2021-08-20 17:07 ` [PATCH RFC 1/3] staging: r8188eu: add proper rtw_read* error handling Pavel Skripkin
2021-08-20 21:50 ` Pavel Skripkin
2021-08-20 23:41 ` Phillip Potter
2021-08-21 5:55 ` Fabio M. De Francesco
2021-08-21 10:35 ` Pavel Skripkin
2021-08-21 12:11 ` Fabio M. De Francesco
2021-08-20 17:07 ` [PATCH RFC 2/3] staging: r8188eu: add error handling to ReadFuse Pavel Skripkin
2021-08-20 23:51 ` Phillip Potter
2021-08-21 3:59 ` Fabio M. De Francesco
2021-08-20 17:07 ` [PATCH RFC 3/3] staging: r8188eu: add error argument to read_macreg Pavel Skripkin
2021-08-20 23:18 ` Phillip Potter
2021-08-21 10:38 ` Pavel Skripkin
2021-08-20 23:12 ` [PATCH RFC 0/3] staging: r8188eu: avoid uninit value bugs Phillip Potter
2021-08-21 10:42 ` Pavel Skripkin
2021-08-22 9:53 ` Fabio M. De Francesco
2021-08-22 10:09 ` Pavel Skripkin [this message]
2021-08-22 10:59 ` Fabio M. De Francesco
2021-08-22 11:34 ` Fabio M. De Francesco
2021-08-22 12:10 ` Pavel Skripkin
2021-08-22 12:39 ` Greg KH
2021-08-22 12:50 ` Pavel Skripkin
2021-08-22 13:06 ` Greg KH
2021-08-22 13:21 ` Fabio M. De Francesco
2021-08-22 13:30 ` Greg KH
2021-08-22 13:31 ` Pavel Skripkin
2021-08-22 14:35 ` [PATCH RFC v2 0/6] " Pavel Skripkin
2021-08-22 14:35 ` [PATCH RFC v2 1/6] staging: r8188eu: remove {read,write}_macreg Pavel Skripkin
2021-08-22 14:35 ` [PATCH RFC v2 2/6] staging: r8188eu: add helper macro for printing registers Pavel Skripkin
2021-08-22 14:35 ` [PATCH RFC v2 3/6] staging: r8188eu: add error handling of rtw_read8 Pavel Skripkin
2021-08-22 14:35 ` [PATCH RFC v2 4/6] staging: r8188eu: add error handling of rtw_read16 Pavel Skripkin
2021-08-22 14:36 ` [PATCH RFC v2 5/6] staging: r8188eu: add error handling of rtw_read32 Pavel Skripkin
2021-08-23 23:33 ` Phillip Potter
2021-08-24 0:10 ` Fabio M. De Francesco
2021-08-24 6:40 ` Pavel Skripkin
2021-08-24 8:38 ` Fabio M. De Francesco
2021-08-24 8:47 ` Pavel Skripkin
2021-08-24 8:53 ` Pavel Skripkin
2021-08-24 9:46 ` Fabio M. De Francesco
2021-08-24 22:10 ` Phillip Potter
2021-08-24 22:07 ` Phillip Potter
2021-08-24 6:53 ` Pavel Skripkin
2021-08-24 7:25 ` [PATCH v3 0/6] staging: r8188eu: avoid uninit value bugs Pavel Skripkin
2021-08-24 7:27 ` [PATCH v3 1/6] staging: r8188eu: remove {read,write}_macreg Pavel Skripkin
2021-08-26 10:39 ` Greg KH
2021-08-26 10:40 ` Greg KH
2021-08-24 7:27 ` [PATCH v3 2/6] staging: r8188eu: add helper macro for printing registers Pavel Skripkin
2021-08-26 10:37 ` Greg KH
2021-08-24 7:27 ` [PATCH v3 3/6] staging: r8188eu: add error handling of rtw_read8 Pavel Skripkin
2021-08-25 12:05 ` kernel test robot
2021-08-25 12:17 ` Pavel Skripkin
2021-08-25 12:51 ` Dan Carpenter
2021-08-25 13:02 ` Pavel Skripkin
2021-08-25 13:34 ` Dan Carpenter
2021-08-25 13:44 ` Pavel Skripkin
2021-08-25 17:11 ` Nick Desaulniers
2021-08-26 11:08 ` Dan Carpenter
2021-08-25 23:45 ` Fabio M. De Francesco
2021-08-26 5:13 ` Pavel Skripkin
2021-08-26 8:21 ` David Laight
2021-08-26 8:27 ` Pavel Skripkin
2021-08-26 10:19 ` David Laight
2021-08-26 11:21 ` Dan Carpenter
2021-08-27 8:14 ` David Laight
2021-08-27 8:22 ` Pavel Skripkin
2021-08-27 9:07 ` Dan Carpenter
2021-08-27 9:16 ` Pavel Skripkin
2021-08-27 9:23 ` Dan Carpenter
2021-08-30 11:21 ` kernel test robot
2021-08-24 7:27 ` [PATCH v3 4/6] staging: r8188eu: add error handling of rtw_read16 Pavel Skripkin
2021-08-25 4:35 ` Fabio M. De Francesco
2021-08-25 8:22 ` Pavel Skripkin
2021-08-25 9:48 ` Fabio M. De Francesco
2021-08-25 9:55 ` Pavel Skripkin
2021-08-25 10:06 ` Dan Carpenter
2021-08-25 10:13 ` Pavel Skripkin
2021-08-25 10:38 ` Dan Carpenter
2021-08-25 10:41 ` Pavel Skripkin
2021-08-25 11:06 ` Fabio M. De Francesco
2021-08-25 11:11 ` Fabio M. De Francesco
2021-08-25 11:31 ` Dan Carpenter
2021-08-25 12:11 ` Fabio M. De Francesco
2021-08-25 10:51 ` Fabio M. De Francesco
2021-08-26 10:50 ` Greg KH
2021-08-26 10:58 ` Pavel Skripkin
2021-08-24 7:27 ` [PATCH v3 5/6] staging: r8188eu: add error handling of rtw_read32 Pavel Skripkin
2021-08-25 4:40 ` Fabio M. De Francesco
2021-08-26 8:51 ` David Laight
2021-08-26 9:22 ` Pavel Skripkin
2021-08-26 9:27 ` Pavel Skripkin
2021-08-26 10:22 ` David Laight
2021-08-26 10:55 ` Pavel Skripkin
2021-08-26 10:59 ` David Laight
2021-08-26 20:03 ` Pavel Skripkin
2021-08-27 7:12 ` gregkh
2021-08-27 7:16 ` Pavel Skripkin
2021-08-24 7:27 ` [PATCH v3 6/6] staging: r8188eu: make ReadEFuse return an int Pavel Skripkin
2021-08-25 10:13 ` [PATCH v3 0/6] staging: r8188eu: avoid uninit value bugs Fabio M. De Francesco
2021-08-27 7:49 ` Kari Argillander
2021-08-27 7:52 ` Pavel Skripkin
2021-08-24 6:58 ` [PATCH RFC v2 5/6] staging: r8188eu: add error handling of rtw_read32 Dan Carpenter
2021-08-24 7:01 ` Pavel Skripkin
2021-08-24 15:07 ` Fabio M. De Francesco
2021-08-22 14:36 ` [PATCH RFC v2 6/6] staging: r8188eu: make ReadEFuse return an int Pavel Skripkin
2021-08-22 15:30 ` [PATCH RFC v2 0/6] staging: r8188eu: avoid uninit value bugs Pavel Skripkin
2021-08-22 16:05 ` Michael Straube
2021-08-22 16:26 ` Pavel Skripkin
2021-08-22 23:52 ` Phillip Potter
2021-08-22 17:36 ` Fabio M. De Francesco
2021-08-22 17:38 ` Pavel Skripkin
2021-08-22 20:06 ` Fabio M. De Francesco
2021-08-22 20:19 ` Pavel Skripkin
2021-08-23 0:12 ` Phillip Potter
2021-08-23 6:38 ` Pavel Skripkin
2021-08-23 6:44 ` Pavel Skripkin
2021-08-22 16:03 ` [PATCH RFC 0/3] " Fabio M. De Francesco
2021-08-22 16:15 ` Pavel Skripkin
2021-08-22 15:04 ` Phillip Potter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ae27d6a0-dc00-459f-7b36-acf7f4c08d72@gmail.com \
--to=paskripkin@gmail.com \
--cc=Larry.Finger@lwfinger.net \
--cc=fmdefrancesco@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=martin@kaiser.cx \
--cc=phil@philpotter.co.uk \
--cc=straube.linux@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).