Re: usb-serial.c question - potential Memory fault

Greg,

It is a problem because I use the pre-allocated buffer given by the layer
usb-serial.
Of course, I can create a new urb structure with a bigger buffer but I just
suggest that 
using the buffer stored in the usb_serial_device seems to be logic and like
a said, other driver use it without checking 
the buffer_size. Are you sure that the pl2303 is well protected against a
buffer overflow ?
What happens if a pl2303 device give a maxsize of 64 bytes like my device ?
The driver will then 
make a buffer overflow and a kernel panic may occur. This was the module I
used to study and write my own driver.


So I agree with the proposition of Oliver to add a buffer_size in the
usb_serial_driver structure.
This is very useful to prepare a buffer able to make bulk transfer.

Regards,

Alain



 
-----Message d'origine-----
De : Greg KH [mailto:[email protected]] 
Envoyé : lundi 30 juillet 2007 17:04
À : [email protected]
Cc : [email protected]
Objet : Re: usb-serial.c question - potential Memory fault

On Mon, Jul 30, 2007 at 07:10:55AM +0200, [email protected] wrote:
> Hi Greg,
> 
> After a new complete reading of my code against usb-serial.c, I finally
> found ( I hope ) my problem.
> In usb-serial.c, when bulk_in/out buffers are initialized, each ?buffer
size
> are the same as the wMaxPacketSize given by the endpoint.
> So, in my case, my device have a value of 64 bytes and I send and receive
> bulk data that might have 256 bytes length !!! And like pl2303, I just
copy
> the user data to port->write_urb->transfer_buffer.
> For all driver that use usb-serial for the probe function, this can be a
> problem (like for me). I have checked for example the pl2303 that never
> check this value before the memcpy.

Why is this a problem for you?  You can use any size buffer you want if
you wish to send more data than what the usb-serial core provides for
you.  Lots of other drivers do that today.

thanks,

greg k-h


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel