Messages in this thread | | | Date | Sun, 17 Mar 2024 08:52:27 +0100 | Subject | Re: [PATCH] usb: typec: anx7411: Fix possible buffer overflow in anx7411_send_msg() | From | Christophe JAILLET <> |
| |
Le 16/03/2024 à 21:33, Grigory Bazilevich a écrit : > Passing a size argument greater than or equal to MAX_BUF_LEN causes > a buffer overflow when the checksum is written. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support") > Signed-off-by: Grigory Bazilevich <bazilevich-vHv2KSI2GGSHXe+LvDLADg@public.gmane.org> > --- > drivers/usb/typec/anx7411.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/anx7411.c b/drivers/usb/typec/anx7411.c > index b12a07edc71b..70ba56dfb22b 100644 > --- a/drivers/usb/typec/anx7411.c > +++ b/drivers/usb/typec/anx7411.c > @@ -733,7 +733,7 @@ static int anx7411_send_msg(struct anx7411_data *ctx, u8 type, u8 *buf, u8 size) > u8 crc; > int ret; > > - size = min_t(u8, size, (u8)MAX_BUF_LEN); > + size = min_t(u8, size, (u8)(MAX_BUF_LEN - 1));
Hi,
with "min_t(u8, ...", is the casting needed?
CJ
> memcpy(msg->buf, buf, size); > msg->msg_type = type; > /* msg len equals buffer length + msg_type */
| |