| Message ID | 20191213023055.19933-2-suwan.kim027@gmail.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | d986294ee55d719562b20aabe15a39bf8f863415 |
| Headers | show |
| Series | usbip: Fix infinite loop in vhci rx | expand |
On 12/12/19 7:30 PM, Suwan Kim wrote: > When vhci uses SG and receives data whose size is smaller than SG > buffer size, it tries to receive more data even if it acutally > receives all the data from the server. If then, it erroneously adds > error event and triggers connection shutdown. > > vhci-hcd should check if it received all the data even if there are > more SG entries left. So, check if it receivces all the data from > the server in for_each_sg() loop. > > Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") > Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> > --- > drivers/usb/usbip/usbip_common.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c > index 6532d68e8808..e4b96674c405 100644 > --- a/drivers/usb/usbip/usbip_common.c > +++ b/drivers/usb/usbip/usbip_common.c > @@ -727,6 +727,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) > > copy -= recv; > ret += recv; > + > + if (!copy) > + break; > } > > if (ret != size) > Thanks Marek and Suwan for taking care of this. Acked-by: Shuah Khan <skhan@linuxfoundation.org> thanks, -- Shuah
diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c index 6532d68e8808..e4b96674c405 100644 --- a/drivers/usb/usbip/usbip_common.c +++ b/drivers/usb/usbip/usbip_common.c @@ -727,6 +727,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) copy -= recv; ret += recv; + + if (!copy) + break; } if (ret != size)
When vhci uses SG and receives data whose size is smaller than SG buffer size, it tries to receive more data even if it acutally receives all the data from the server. If then, it erroneously adds error event and triggers connection shutdown. vhci-hcd should check if it received all the data even if there are more SG entries left. So, check if it receivces all the data from the server in for_each_sg() loop. Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> --- drivers/usb/usbip/usbip_common.c | 3 +++ 1 file changed, 3 insertions(+)