Re: usb devicefs flaw

From: Andries.Brouwer@cwi.nl
Date: Sun Aug 04 2002 - 15:07:57 EST


> Fix is already in Linus's tree, thanks to David Brownell

Good!
For myself I had made the fix with * instead of /.
But yes, 0 is unambiguous.

Another problem that I see under not yet determined circumstances
is "Too many links" when I do "cat product" or "cat manufacturer"
for some USB device in the devicefs tree.
This -EMLINK smells like some random negative number.
Now usb_string() in usb/core/message.c can return an error,
but routines like show_product() and show_manufacturer()
in usb/core/usb.c blindly do
        len = usb_string(...);
        buf[len] = '\n';
        buf[len+1] = 0x00;
        return len+1;
so that in case of an error some random memory is corrupted.
In other words: everywhere the return value of usb_string()
must be checked.

Andries

[Concerning the -EMLINK, I bet that usb_string() returned -EPIPE
which is -32, so that here -31, that is, -EMLINK, is returned.]
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed Aug 07 2002 - 22:00:25 EST