Re: [PATCH] USB: add USB test and measurement class driver
From: Greg KH
Date: Wed Aug 27 2008 - 12:24:26 EST
On Wed, Aug 27, 2008 at 10:13:06AM +0200, Oliver Neukum wrote:
> Am Mittwoch 27 August 2008 02:05:01 schrieb Greg KH:
> > +static ssize_t usbtmc_read(struct file *filp, char __user *buf,
> > + size_t count, loff_t *f_pos)
> > +{
> > + struct usbtmc_device_data *data;
> > + struct device *dev;
> > + unsigned long int n_characters;
> > + u8 *buffer;
> > + int actual;
> > + int done;
> > + int remaining;
> > + int retval;
> > + int this_part;
> > +
> > + /* Get pointer to private data structure */
> > + data = filp->private_data;
> > + dev = &data->intf->dev;
> > + buffer = data->buffer;
> > +
> > + remaining = count;
> > + done = 0;
> > +
> > + while (remaining > 0) {
> > + if (remaining > USBTMC_SIZE_IOBUFFER - 12 - 3)
> > + this_part = USBTMC_SIZE_IOBUFFER - 12 - 3;
> > + else
> > + this_part = remaining;
> > +
> > + /* Setup IO buffer for DEV_DEP_MSG_IN message
> > + * Refer to class specs for details
> > + */
> > + buffer[0] = 2;
> > + buffer[1] = data->bTag;
> > + buffer[2] = ~(data->bTag);
> > + buffer[3] = 0; /* Reserved */
> > + buffer[4] = (this_part - 12 - 3) & 255;
> > + buffer[5] = ((this_part - 12 - 3) >> 8) & 255;
> > + buffer[6] = ((this_part - 12 - 3) >> 16) & 255;
> > + buffer[7] = ((this_part - 12 - 3) >> 24) & 255;
> > + buffer[8] = data->TermCharEnabled * 2;
> > + /* Use term character? */
> > + buffer[9] = data->TermChar;
> > + buffer[10] = 0; /* Reserved */
> > + buffer[11] = 0; /* Reserved */
>
> This function will go bad if concurrent readers enter, yet it has no locking.
Now fixed with an i/o mutex.
thanks,
greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/