[PATCH] rspiusb: Check usb_buffer_map_sg() retval

Roel Kluin roel.kluin at gmail.com
Sat Aug 22 16:56:27 UTC 2009


usb_buffer_map_sg() may return -1, check this directly.

Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
---
>> usb_buffer_map_sg() may return -1. This will result in a read from
>> pdx->PixelUrb[frameInfo][-1]

>> +	if (i == 0)
>> +		return -EINVAL;

> This is rather pointless. If usb_buffer_map_sg returns error (negative
> value), we will die earlier on most machines, since we pass some
> 0xffffffXX to kmalloc as a size.
> 
> The proper fix is to check usb_buffer_map_sg retval here.

good point, 

How about this?

sgEntries[frameInfo] is unsigned so we cannot test `< 0' on that.

diff --git a/drivers/staging/rspiusb/rspiusb.c b/drivers/staging/rspiusb/rspiusb.c
index 04e2f92..acafbd8 100644
--- a/drivers/staging/rspiusb/rspiusb.c
+++ b/drivers/staging/rspiusb/rspiusb.c
@@ -611,6 +611,7 @@ static int MapUserBuffer(struct ioctl_struct *io, struct device_extension *pdx)
 	int i = 0;
 	int k = 0;
 	int err = 0;
+	int ret;
 	struct page **maplist_p;
 	int numPagesRequired;
 
@@ -687,9 +688,13 @@ static int MapUserBuffer(struct ioctl_struct *io, struct device_extension *pdx)
 	} else {
 		pdx->sgl[frameInfo][0].length = count;
 	}
-	pdx->sgEntries[frameInfo] =
-	    usb_buffer_map_sg(pdx->udev, epAddr, pdx->sgl[frameInfo],
-			      pdx->maplist_numPagesMapped[frameInfo]);
+	ret = usb_buffer_map_sg(pdx->udev, epAddr, pdx->sgl[frameInfo],
+			pdx->maplist_numPagesMapped[frameInfo]);
+	if (ret < 0)
+		return -EINVAL;
+
+	pdx->sgEntries[frameInfo] = ret;
+
 	dbg("number of sgEntries = %d", pdx->sgEntries[frameInfo]);
 	pdx->userBufMapped = 1;
 	vfree(maplist_p);
@@ -716,8 +721,6 @@ static int MapUserBuffer(struct ioctl_struct *io, struct device_extension *pdx)
 		pdx->PixelUrb[frameInfo][i]->transfer_flags =
 		    URB_NO_TRANSFER_DMA_MAP | URB_NO_INTERRUPT;
 	}
-	if (i == 0)
-		return -EINVAL;
 	/* only interrupt when last URB completes */
 	pdx->PixelUrb[frameInfo][--i]->transfer_flags &= ~URB_NO_INTERRUPT;
 	pdx->pendedPixelUrbs[frameInfo] =



More information about the devel mailing list