On Fri, Sep 15, 2023 at 11:39:48AM +0530, Krishna Kurapati wrote:
When NCM is used with hosts like Windows PC, it is observed that there are multiple NTB's contained in one usb request giveback. Since the driver unwraps the obtained request data assuming only one NTB is present, we loose the subsequent NTB's present resulting in data loss.
Fix this by checking the parsed block length with the obtained data length in usb request and continue parsing after the last byte of current NTB.
Cc: stable@vger.kernel.org
What commit id does this fix?
Reviewed-by: Maciej Żenczykowski maze@google.com Signed-off-by: Krishna Kurapati quic_kriskura@quicinc.com
drivers/usb/gadget/function/f_ncm.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index feccf4c8cc4f..f00f051438ec 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1156,7 +1156,8 @@ static int ncm_unwrap_ntb(struct gether *port, struct sk_buff_head *list) { struct f_ncm *ncm = func_to_ncm(&port->func);
- __le16 *tmp = (void *) skb->data;
- unsigned char *ntb_ptr = (void *) skb->data;
Why persist with the extra ' ', didn't checkpatch complain about this?
And why the cast at all?
- __le16 *tmp; unsigned index, index2; int ndp_index; unsigned dg_len, dg_len2;
@@ -1169,6 +1170,10 @@ static int ncm_unwrap_ntb(struct gether *port, const struct ndp_parser_opts *opts = ncm->parser_opts; unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; int dgram_counter;
- int to_process = skb->len;
+parse_ntb:
- tmp = (void *) ntb_ptr;
Again, no blank space please.
And why the cast?
thanks,
greg k-h