Re: [PATCH 09/15] usb: serial: io_edgeport: use usb_control_msg_recv() and usb_control_msg_send()
From: Johan Hovold <johan@kernel.org>
Date: 2020-12-04 10:11:07
Also in:
linux-kernel-mentees, lkml
On Wed, Nov 04, 2020 at 12:16:57PM +0530, Himadri Pandya wrote:
quoted hunk ↗ jump to hunk
The new usb_control_msg_recv() and usb_control_msg_send() nicely wraps usb_control_msg() with proper error check. Hence use the wrappers instead of calling usb_control_msg() directly. Signed-off-by: Himadri Pandya <redacted> --- drivers/usb/serial/io_edgeport.c | 73 ++++++++++++-------------------- 1 file changed, 27 insertions(+), 46 deletions(-)diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index ba5d8df69518..8479d5684af7 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c@@ -568,34 +568,29 @@ static int get_epic_descriptor(struct edgeport_serial *ep) int result; struct usb_serial *serial = ep->serial; struct edgeport_product_info *product_info = &ep->product_info; - struct edge_compatibility_descriptor *epic; + struct edge_compatibility_descriptor epic; struct edge_compatibility_bits *bits; struct device *dev = &serial->dev->dev; ep->is_epic = 0; - epic = kmalloc(sizeof(*epic), GFP_KERNEL); - if (!epic) - return -ENOMEM; - - result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), - USB_REQUEST_ION_GET_EPIC_DESC, - 0xC0, 0x00, 0x00, - epic, sizeof(*epic), - 300); - if (result == sizeof(*epic)) { + result = usb_control_msg_recv(serial->dev, 0, + USB_REQUEST_ION_GET_EPIC_DESC, 0xC0, + 0x00, 0x00, &epic, sizeof(epic), 300, + GFP_KERNEL); + if (result) {
Here's another logical error due to the test being inverted, which results in the uninitialised stack-allocated buffer to be used for debug printks (potentially leaking stack data) in case of errors.
quoted hunk ↗ jump to hunk
ep->is_epic = 1; - memcpy(&ep->epic_descriptor, epic, sizeof(*epic)); + memcpy(&ep->epic_descriptor, &epic, sizeof(epic)); memset(product_info, 0, sizeof(struct edgeport_product_info)); - product_info->NumPorts = epic->NumPorts; + product_info->NumPorts = epic.NumPorts; product_info->ProdInfoVer = 0; - product_info->FirmwareMajorVersion = epic->MajorVersion; - product_info->FirmwareMinorVersion = epic->MinorVersion; - product_info->FirmwareBuildNumber = epic->BuildNumber; - product_info->iDownloadFile = epic->iDownloadFile; - product_info->EpicVer = epic->EpicVer; - product_info->Epic = epic->Supports; + product_info->FirmwareMajorVersion = epic.MajorVersion; + product_info->FirmwareMinorVersion = epic.MinorVersion; + product_info->FirmwareBuildNumber = epic.BuildNumber; + product_info->iDownloadFile = epic.iDownloadFile; + product_info->EpicVer = epic.EpicVer; + product_info->Epic = epic.Supports; product_info->ProductId = ION_DEVICE_ID_EDGEPORT_COMPATIBLE; dump_product_info(ep, product_info);@@ -614,16 +609,12 @@ static int get_epic_descriptor(struct edgeport_serial *ep) dev_dbg(dev, " IOSPWriteLCR : %s\n", bits->IOSPWriteLCR ? "TRUE": "FALSE"); dev_dbg(dev, " IOSPSetBaudRate : %s\n", bits->IOSPSetBaudRate ? "TRUE": "FALSE"); dev_dbg(dev, " TrueEdgeport : %s\n", bits->TrueEdgeport ? "TRUE": "FALSE"); - - result = 0; - } else if (result >= 0) { + } else { dev_warn(&serial->interface->dev, "short epic descriptor received: %d\n", result); result = -EIO;
...and the driver now always fails to probe with -EIO.
quoted hunk ↗ jump to hunk
} - kfree(epic); - return result; }@@ -2168,11 +2159,6 @@ static int rom_read(struct usb_serial *serial, __u16 extAddr, { int result; __u16 current_length; - unsigned char *transfer_buffer; - - transfer_buffer = kmalloc(64, GFP_KERNEL); - if (!transfer_buffer) - return -ENOMEM; /* need to split these reads up into 64 byte chunks */ result = 0;@@ -2181,25 +2167,18 @@ static int rom_read(struct usb_serial *serial, __u16 extAddr, current_length = 64; else current_length = length; - result = usb_control_msg(serial->dev, - usb_rcvctrlpipe(serial->dev, 0), - USB_REQUEST_ION_READ_ROM, - 0xC0, addr, extAddr, transfer_buffer, - current_length, 300); - if (result < current_length) { - if (result >= 0) - result = -EIO; + result = usb_control_msg_recv(serial->dev, 0, + USB_REQUEST_ION_READ_ROM, 0xC0, + addr, extAddr, data, + current_length, 300, GFP_KERNEL); + if (result) break; - } - memcpy(data, transfer_buffer, current_length); + length -= current_length; addr += current_length; data += current_length; - result = 0; } - - kfree(transfer_buffer); return result; }
Here a single allocation of a buffer that get's used repeatedly is replaced with one allocation per iteration. I suggest leaving this as is. Please just drop this patch. Johan