lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 497/530] usb: musb: Fix musb_gadget.c rxstate overflow bug
    Date
    From: Robin Guo <guoweibin@inspur.com>

    [ Upstream commit eea4c860c3b366369eff0489d94ee4f0571d467d ]

    The usb function device call musb_gadget_queue() adds the passed
    request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz)
    and (is_buffer_mapped(req) return false),the rxstate() will copy all data
    in fifo to request->buf which may cause request->buf out of bounds.

    Fix it by add the length check :
    fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);

    Signed-off-by: Robin Guo <guoweibin@inspur.com>
    Link: https://lore.kernel.org/r/20220906102119.1b071d07a8391ff115e6d1ef@inspur.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/musb/musb_gadget.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
    index 51274b87f46c..dc67fff8e941 100644
    --- a/drivers/usb/musb/musb_gadget.c
    +++ b/drivers/usb/musb/musb_gadget.c
    @@ -760,6 +760,9 @@ static void rxstate(struct musb *musb, struct musb_request *req)
    musb_writew(epio, MUSB_RXCSR, csr);

    buffer_aint_mapped:
    + fifo_count = min_t(unsigned int,
    + request->length - request->actual,
    + (unsigned int)fifo_count);
    musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
    (request->buf + request->actual));
    request->actual += fifo_count;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 16:59    [W:4.029 / U:0.896 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site