* [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
@ 2022-07-27 8:43 Andy Guo (郭卫斌)
2022-07-27 9:25 ` gregkh
0 siblings, 1 reply; 5+ messages in thread
From: Andy Guo (郭卫斌) @ 2022-07-27 8:43 UTC (permalink / raw)
To: b-liu, gregkh
Cc: linux-usb, linux-kernel, Andy Guo (郭卫斌)
[-- Attachment #1: Type: text/plain, Size: 1114 bytes --]
From: guoweibin <guoweibin@inspur.com>
when the rxstate function executes the 'goto buffer_aint_mapped' code
branch, it will always copy the fifocnt bytes data to request->buf,
which may cause request->buf out of bounds. for Ethernet-over-USB will
cause skb_over_panic when a packet larger than mtu is recived.
Fix it by add the length check :
fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);
Signed-off-by: guoweibin <guoweibin@inspur.com>
---
v2:
-fix format error
drivers/usb/musb/musb_gadget.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 51274b87f46c..4ad5a1f31d7e 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -760,6 +760,7 @@ static void rxstate(struct musb *musb, struct musb_request *req)
musb_writew(epio, MUSB_RXCSR, csr);
buffer_aint_mapped:
+ fifo_count = min_t(unsigned, request->length - request->actual, fifo_count);
musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
(request->buf + request->actual));
request->actual += fifo_count;
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 3801 bytes --]
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
2022-07-27 8:43 [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems Andy Guo (郭卫斌)
@ 2022-07-27 9:25 ` gregkh
2022-07-28 1:14 ` 答复: [vger.kernel.org代发]Re: " Andy Guo (郭卫斌)
0 siblings, 1 reply; 5+ messages in thread
From: gregkh @ 2022-07-27 9:25 UTC (permalink / raw)
To: Andy Guo (郭卫斌); +Cc: b-liu, linux-usb, linux-kernel
On Wed, Jul 27, 2022 at 08:43:34AM +0000, Andy Guo (郭卫斌) wrote:
> From: guoweibin <guoweibin@inspur.com>
Your From: in your email has your real name, why not use that instead of
just putting your email alias here?
>
> when the rxstate function executes the 'goto buffer_aint_mapped' code
> branch, it will always copy the fifocnt bytes data to request->buf,
> which may cause request->buf out of bounds. for Ethernet-over-USB will
> cause skb_over_panic when a packet larger than mtu is recived.
How can we get a bigger packet than mtu?
>
> Fix it by add the length check :
> fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);
>
> Signed-off-by: guoweibin <guoweibin@inspur.com>
Same here.
> ---
> v2:
> -fix format error
> drivers/usb/musb/musb_gadget.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
> index 51274b87f46c..4ad5a1f31d7e 100644
> --- a/drivers/usb/musb/musb_gadget.c
> +++ b/drivers/usb/musb/musb_gadget.c
> @@ -760,6 +760,7 @@ static void rxstate(struct musb *musb, struct musb_request *req)
> musb_writew(epio, MUSB_RXCSR, csr);
>
> buffer_aint_mapped:
> + fifo_count = min_t(unsigned, request->length - request->actual, fifo_count);
Why the case to "unsigned"?
And if we get a too big packet, shouldn't we drop it?
And what does this have to do with a usb-ethernet device, this is in the
generic musb code, not an ethernet driver.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* 答复: [vger.kernel.org代发]Re: [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
2022-07-27 9:25 ` gregkh
@ 2022-07-28 1:14 ` Andy Guo (郭卫斌)
2022-07-28 6:56 ` gregkh
0 siblings, 1 reply; 5+ messages in thread
From: Andy Guo (郭卫斌) @ 2022-07-28 1:14 UTC (permalink / raw)
To: gregkh; +Cc: b-liu, linux-usb, linux-kernel
[-- Attachment #1: smime.p7m --]
[-- Type: application/pkcs7-mime, Size: 8738 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: 答复: [vger.kernel.org代发]Re: [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
2022-07-28 1:14 ` 答复: [vger.kernel.org代发]Re: " Andy Guo (郭卫斌)
@ 2022-07-28 6:56 ` gregkh
2022-07-28 12:24 ` Andy Guo (郭卫斌)
0 siblings, 1 reply; 5+ messages in thread
From: gregkh @ 2022-07-28 6:56 UTC (permalink / raw)
To: Andy Guo (郭卫斌); +Cc: b-liu, linux-usb, linux-kernel
On Thu, Jul 28, 2022 at 01:14:17AM +0000, Andy Guo (郭卫斌) wrote:
As can be seen in the archives:
https://lore.kernel.org/all/2c234d13d7274763b0102b83ce65b8ff@inspur.com/
this message could not be decoded, sorry.
Please resend in plain text format.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: 答复: [vger.kernel.org代发]Re: [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
2022-07-28 6:56 ` gregkh
@ 2022-07-28 12:24 ` Andy Guo (郭卫斌)
0 siblings, 0 replies; 5+ messages in thread
From: Andy Guo (郭卫斌) @ 2022-07-28 12:24 UTC (permalink / raw)
To: gregkh; +Cc: b-liu, linux-usb, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 820 bytes --]
I'm sorroy,
I use Enterprise mailbox doesn't work very well.
I will send this patch through another mailbox.
Thanks
guoweibin
-----Original Message-----
From: gregkh@linuxfoundation.org <gregkh@linuxfoundation.org>
Sent: Thursday, July 28, 2022 2:57 PM
To: Andy Guo (郭卫斌) <guoweibin@inspur.com>
Cc: b-liu@ti.com; linux-usb@vger.kernel.org; linux-kernel@vger.kernel.org
Subject: Re: 答复: [vger.kernel.org代发]Re: [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
On Thu, Jul 28, 2022 at 01:14:17AM +0000, Andy Guo (郭卫斌) wrote:
As can be seen in the archives:
https://lore.kernel.org/all/2c234d13d7274763b0102b83ce65b8ff@inspur.com/
this message could not be decoded, sorry.
Please resend in plain text format.
thanks,
greg k-h
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 2867 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-07-28 12:24 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-27 8:43 [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems Andy Guo (郭卫斌)
2022-07-27 9:25 ` gregkh
2022-07-28 1:14 ` 答复: [vger.kernel.org代发]Re: " Andy Guo (郭卫斌)
2022-07-28 6:56 ` gregkh
2022-07-28 12:24 ` Andy Guo (郭卫斌)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.