Re: [PATCH] drivers/usb/host/uhci-* : check buffer length to avoid memory overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



于 2013年01月09日 04:53, Alan Stern 写道:
> Gang:
> 
> I apologize for taking so long to respond to your patch.  I didn't get 
> much work done during the holidays...
> 
  I understand. it is necessary to have a rest, so can keep our
contributes (work), with efficiency and sustainable.

  :-)


> Can you rewrite this using ordinary English sentences?  Describe what 
> you changed and why you changed it.  You don't have to include the 
> details of your tests.
> 
  ok, thanks.


>> +#define LEFT_OUTPUT	(1024)
> 
> A better name would be EXTRA_SPACE.
> 
  ok, thanks.


>> @@ -90,7 +90,11 @@ static int uhci_show_td(struct uhci_hcd *uhci, struct uhci_td *td, char *buf,
>>  		spid);
>>  	out += sprintf(out, "(buf=%08x)\n", hc32_to_cpu(uhci, td->buffer));
>>  
>> +tail:
>>  	return out - buf;
>> +truncate:
>> +	out += sprintf(out, " (%s truncated)\n", __FUNCTION__);
>> +	goto tail;
>>  }
> 
> Here and in all the other functions, it would be better to do this:
> 
> + done:
> +	if (out - buf > len)
> +		out += sprintf(out, " ...\n");
>  	return out - buf;
>  }
  ok, thanks.

> 
> You don't need to write the word "truncated" all the time.  A simple 
> "..." will let people know what happened.
> 
> Have all the "goto" statements jump to "done".  The reason for doing it 
> this way is...
> 
  ok, thanks.


>> @@ -135,6 +142,8 @@ static int uhci_show_urbp(struct uhci_hcd *uhci, struct urb_priv *urbp,
>>  			out += sprintf(out, "%*s%d: ", space + 2, "", i);
>>  			out += uhci_show_td(uhci, td, out,
>>  					len - (out - buf), 0);
>> +			if (out - buf > len)
>> +				goto truncate;
> 
> .. here you can jump directly to the return statement and avoid 
> printing out a duplicate "..." line.
>
  ok, thanks.

  I think your meaning is:
    use "goto tail;" instead of "goto truncate;"
    and the return area like this:

+ done:
+	if (out - buf > len)
+		out += sprintf(out, " ...\n");
+ tail:
 	return out - buf;
 }

  if I misunderstanding, please reply.
    (no reply means I am not misunderstanding)


>> @@ -375,14 +402,19 @@ static int uhci_sprint_schedule(struct uhci_hcd *uhci, char *buf, int len)
>>  			uhci_to_hcd(uhci)->self.bandwidth_int_reqs,
>>  			uhci_to_hcd(uhci)->self.bandwidth_isoc_reqs);
>>  	if (debug <= 1)
>> -		return out - buf;
>> +		goto tail;
>>  
>>  	out += sprintf(out, "Frame List\n");
>> +	if (out - buf > len)
>> +		goto truncate;
> 
> This test isn't needed because there's another test inside the loop 
> below.
> 
  ok, thanks.



  I will send patch v2 within 4 days
   (execuse me, today and tommorrow, I have to do another things)

-- 
Chen Gang

Asianux Corporation
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux