lkml.org 
[lkml]   [2022]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 022/475] xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
    Date
    From: Anssi Hannula <anssi.hannula@bitwise.fi>

    commit 05519b8589a679edb8fa781259893d20bece04ad upstream.

    xhci_decode_ctrl_ctx() returns the untouched buffer as-is if both "drop"
    and "add" parameters are zero.

    Fix the function to return an empty string in that case.

    It was not immediately clear from the possible call chains whether this
    issue is currently actually triggerable or not.

    Note that before commit 4843b4b5ec64 ("xhci: fix even more unsafe memory
    usage in xhci tracing") the result effect in the failure case was different
    as a static buffer was used here, but the code still worked incorrectly.

    Fixes: 90d6d5731da7 ("xhci: Add tracing for input control context")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    commit 4843b4b5ec64 ("xhci: fix even more unsafe memory usage in xhci tracing")
    Link: https://lore.kernel.org/r/20220303110903.1662404-4-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/host/xhci.h | 2 ++
    1 file changed, 2 insertions(+)

    --- a/drivers/usb/host/xhci.h
    +++ b/drivers/usb/host/xhci.h
    @@ -2452,6 +2452,8 @@ static inline const char *xhci_decode_ct
    unsigned int bit;
    int ret = 0;

    + str[0] = '\0';
    +
    if (drop) {
    ret = sprintf(str, "Drop:");
    for_each_set_bit(bit, &drop, 32)

    \
     
     \ /
      Last update: 2022-04-14 16:14    [W:4.016 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site