X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=drivers%2Fusb%2Fmon%2Fmon_text.c;h=05cf2c9a8f84c3fbb42ffaaabf971d8bd2a526ea;hb=97bf2856c6014879bd04983a3e9dfcdac1e7fe85;hp=611612146ae976ef4a2a48799d8da4db2969b1e8;hpb=76828883507a47dae78837ab5dec5a5b4513c667;p=linux-2.6.git diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c index 611612146..05cf2c9a8 100644 --- a/drivers/usb/mon/mon_text.c +++ b/drivers/usb/mon/mon_text.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include "usb_mon.h" @@ -25,10 +26,13 @@ /* * This limit exists to prevent OOMs when the user process stops reading. + * If usbmon were available to unprivileged processes, it might be open + * to a local DoS. But we have to keep to root in order to prevent + * password sniffing from HID devices. */ -#define EVENT_MAX 25 +#define EVENT_MAX (2*PAGE_SIZE / sizeof(struct mon_event_text)) -#define PRINTF_DFL 130 +#define PRINTF_DFL 160 struct mon_event_text { struct list_head e_link; @@ -46,7 +50,7 @@ struct mon_event_text { #define SLAB_NAME_SZ 30 struct mon_reader_text { - kmem_cache_t *e_slab; + struct kmem_cache *e_slab; int nevents; struct list_head e_list; struct mon_reader r; /* In C, parent class can be placed anywhere */ @@ -54,13 +58,12 @@ struct mon_reader_text { wait_queue_head_t wait; int printf_size; char *printf_buf; - struct semaphore printf_lock; + struct mutex printf_lock; char slab_name[SLAB_NAME_SZ]; }; -static void mon_text_ctor(void *, kmem_cache_t *, unsigned long); -static void mon_text_dtor(void *, kmem_cache_t *, unsigned long); +static void mon_text_ctor(void *, struct kmem_cache *, unsigned long); /* * mon_text_submit @@ -72,13 +75,13 @@ static void mon_text_dtor(void *, kmem_cache_t *, unsigned long); */ static inline char mon_text_get_setup(struct mon_event_text *ep, - struct urb *urb, char ev_type) + struct urb *urb, char ev_type, struct mon_bus *mbus) { if (!usb_pipecontrol(urb->pipe) || ev_type != 'S') return '-'; - if (urb->transfer_flags & URB_NO_SETUP_DMA_MAP) + if (mbus->uses_dma && (urb->transfer_flags & URB_NO_SETUP_DMA_MAP)) return mon_dmapeek(ep->setup, urb->setup_dma, SETUP_MAX); if (urb->setup_packet == NULL) return 'Z'; /* '0' would be not as pretty. */ @@ -88,7 +91,7 @@ static inline char mon_text_get_setup(struct mon_event_text *ep, } static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb, - int len, char ev_type) + int len, char ev_type, struct mon_bus *mbus) { int pipe = urb->pipe; @@ -110,11 +113,11 @@ static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb, * number of corner cases, but it seems that the following is * more or less safe. * - * We do not even try to look transfer_buffer, because it can + * We do not even try to look at transfer_buffer, because it can * contain non-NULL garbage in case the upper level promised to * set DMA for the HCD. */ - if (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) + if (mbus->uses_dma && (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) return mon_dmapeek(ep->data, urb->transfer_dma, len); if (urb->transfer_buffer == NULL) @@ -144,7 +147,7 @@ static void mon_text_event(struct mon_reader_text *rp, struct urb *urb, stamp = mon_get_timestamp(); if (rp->nevents >= EVENT_MAX || - (ep = kmem_cache_alloc(rp->e_slab, SLAB_ATOMIC)) == NULL) { + (ep = kmem_cache_alloc(rp->e_slab, GFP_ATOMIC)) == NULL) { rp->r.m_bus->cnt_text_lost++; return; } @@ -158,8 +161,9 @@ static void mon_text_event(struct mon_reader_text *rp, struct urb *urb, /* Collecting status makes debugging sense for submits, too */ ep->status = urb->status; - ep->setup_flag = mon_text_get_setup(ep, urb, ev_type); - ep->data_flag = mon_text_get_data(ep, urb, ep->length, ev_type); + ep->setup_flag = mon_text_get_setup(ep, urb, ev_type, rp->r.m_bus); + ep->data_flag = mon_text_get_data(ep, urb, ep->length, ev_type, + rp->r.m_bus); rp->nevents++; list_add_tail(&ep->e_link, &rp->e_list); @@ -178,6 +182,32 @@ static void mon_text_complete(void *data, struct urb *urb) mon_text_event(rp, urb, 'C'); } +static void mon_text_error(void *data, struct urb *urb, int error) +{ + struct mon_reader_text *rp = data; + struct mon_event_text *ep; + + if (rp->nevents >= EVENT_MAX || + (ep = kmem_cache_alloc(rp->e_slab, GFP_ATOMIC)) == NULL) { + rp->r.m_bus->cnt_text_lost++; + return; + } + + ep->type = 'E'; + ep->pipe = urb->pipe; + ep->id = (unsigned long) urb; + ep->tstamp = 0; + ep->length = 0; + ep->status = error; + + ep->setup_flag = '-'; + ep->data_flag = 'E'; + + rp->nevents++; + list_add_tail(&ep->e_link, &rp->e_list); + wake_up(&rp->wait); +} + /* * Fetch next event from the circular buffer. */ @@ -208,19 +238,18 @@ static int mon_text_open(struct inode *inode, struct file *file) struct mon_reader_text *rp; int rc; - down(&mon_lock); - mbus = inode->u.generic_ip; + mutex_lock(&mon_lock); + mbus = inode->i_private; ubus = mbus->u_bus; - rp = kmalloc(sizeof(struct mon_reader_text), GFP_KERNEL); + rp = kzalloc(sizeof(struct mon_reader_text), GFP_KERNEL); if (rp == NULL) { rc = -ENOMEM; goto err_alloc; } - memset(rp, 0, sizeof(struct mon_reader_text)); INIT_LIST_HEAD(&rp->e_list); init_waitqueue_head(&rp->wait); - init_MUTEX(&rp->printf_lock); + mutex_init(&rp->printf_lock); rp->printf_size = PRINTF_DFL; rp->printf_buf = kmalloc(rp->printf_size, GFP_KERNEL); @@ -232,13 +261,14 @@ static int mon_text_open(struct inode *inode, struct file *file) rp->r.m_bus = mbus; rp->r.r_data = rp; rp->r.rnf_submit = mon_text_submit; + rp->r.rnf_error = mon_text_error; rp->r.rnf_complete = mon_text_complete; snprintf(rp->slab_name, SLAB_NAME_SZ, "mon%dt_%lx", ubus->busnum, (long)rp); rp->e_slab = kmem_cache_create(rp->slab_name, sizeof(struct mon_event_text), sizeof(long), 0, - mon_text_ctor, mon_text_dtor); + mon_text_ctor, NULL); if (rp->e_slab == NULL) { rc = -ENOMEM; goto err_slab; @@ -247,7 +277,7 @@ static int mon_text_open(struct inode *inode, struct file *file) mon_reader_add(mbus, &rp->r); file->private_data = rp; - up(&mon_lock); + mutex_unlock(&mon_lock); return 0; // err_busy: @@ -257,7 +287,7 @@ err_slab: err_alloc_pr: kfree(rp); err_alloc: - up(&mon_lock); + mutex_unlock(&mon_lock); return rc; } @@ -301,7 +331,7 @@ static ssize_t mon_text_read(struct file *file, char __user *buf, set_current_state(TASK_RUNNING); remove_wait_queue(&rp->wait, &waita); - down(&rp->printf_lock); + mutex_lock(&rp->printf_lock); cnt = 0; pbuf = rp->printf_buf; limit = rp->printf_size; @@ -358,7 +388,7 @@ static ssize_t mon_text_read(struct file *file, char __user *buf, if (copy_to_user(buf, rp->printf_buf, cnt)) cnt = -EFAULT; - up(&rp->printf_lock); + mutex_unlock(&rp->printf_lock); kmem_cache_free(rp->e_slab, ep); return cnt; } @@ -371,12 +401,12 @@ static int mon_text_release(struct inode *inode, struct file *file) struct list_head *p; struct mon_event_text *ep; - down(&mon_lock); - mbus = inode->u.generic_ip; + mutex_lock(&mon_lock); + mbus = inode->i_private; if (mbus->nreaders <= 0) { printk(KERN_ERR TAG ": consistency error on close\n"); - up(&mon_lock); + mutex_unlock(&mon_lock); return 0; } mon_reader_del(mbus, &rp->r); @@ -402,11 +432,11 @@ static int mon_text_release(struct inode *inode, struct file *file) kfree(rp->printf_buf); kfree(rp); - up(&mon_lock); + mutex_unlock(&mon_lock); return 0; } -struct file_operations mon_fops_text = { +const struct file_operations mon_fops_text = { .owner = THIS_MODULE, .open = mon_text_open, .llseek = no_llseek, @@ -420,7 +450,7 @@ struct file_operations mon_fops_text = { /* * Slab interface: constructor. */ -static void mon_text_ctor(void *mem, kmem_cache_t *slab, unsigned long sflags) +static void mon_text_ctor(void *mem, struct kmem_cache *slab, unsigned long sflags) { /* * Nothing to initialize. No, really! @@ -429,7 +459,3 @@ static void mon_text_ctor(void *mem, kmem_cache_t *slab, unsigned long sflags) memset(mem, 0xe5, sizeof(struct mon_event_text)); } -static void mon_text_dtor(void *mem, kmem_cache_t *slab, unsigned long sflags) -{ - ; -}