From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F14DFC43334 for ; Tue, 7 Jun 2022 13:47:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244965AbiFGNrr (ORCPT ); Tue, 7 Jun 2022 09:47:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244898AbiFGNrb (ORCPT ); Tue, 7 Jun 2022 09:47:31 -0400 Received: from smtp.ruc.edu.cn (m177126.mail.qiye.163.com [123.58.177.126]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3DD2275D5 for ; Tue, 7 Jun 2022 06:47:28 -0700 (PDT) Received: from localhost.localdomain (unknown [202.112.113.212]) by smtp.ruc.edu.cn (Hmail) with ESMTPSA id 142AB80053; Tue, 7 Jun 2022 21:47:26 +0800 (CST) From: Xiaohui Zhang To: Xiaohui Zhang , Ian Abbott , H Hartley Sweeten , Greg Kroah-Hartman , Johan Hovold , linux-kernel@vger.kernel.org Subject: [PATCH V2 1/1] comedi: ni_usb6501: fix transfer-buffer overflows Date: Tue, 7 Jun 2022 21:47:20 +0800 Message-Id: <20220607134720.6343-1-xiaohuizhang@ruc.edu.cn> X-Mailer: git-send-email 2.17.1 X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgPGg8OCBgUHx5ZQUlOS1dZCBgUCR5ZQVlLVUtZV1 kWDxoPAgseWUFZKDYvK1lXWShZQUhPN1dZLVlBSVdZDwkaFQgSH1lBWRpKSUpWGE9MThgaSB8eTx 5NVRMBExYaEhckFA4PWVdZFhoPEhUdFFlBWU9LSFVKSktISkNVS1kG X-HM-Sender-Digest: e1kMHhlZQR0aFwgeV1kSHx4VD1lBWUc6PRA6Eww*Cj09MRcYEU81Swsq L0wKCyhVSlVKTU5PTUtCTU9NTE1MVTMWGhIXVQMSGhQTDhIBExoVHDsJDhhVHh8OVRgVRVlXWRIL WUFZSUtJVUpKSVVKSkhVSUpJWVdZCAFZQUlOT0k3Bg++ X-HM-Tid: 0a813e6b92d52c20kusn142ab80053 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Similar to the handling of vmk80xx_alloc_usb_buffers in commit a23461c47482("comedi: vmk80xx: fix transfer-buffer overflows"), we thought a patch might be needed here as well. The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. --- Fix the typo in the last bit of the old patch which use the wrong endpoint to determine the size for usb_tx_buf. Signed-off-by: Xiaohui Zhang --- drivers/comedi/drivers/ni_usb6501.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/comedi/drivers/ni_usb6501.c b/drivers/comedi/drivers/ni_usb6501.c index 0dd9edf7bced..8303bfc305c5 100644 --- a/drivers/comedi/drivers/ni_usb6501.c +++ b/drivers/comedi/drivers/ni_usb6501.c @@ -90,6 +90,7 @@ #include #define NI6501_TIMEOUT 1000 +#define MIN_BUF_SIZE 64 /* Port request packets */ static const u8 READ_PORT_REQUEST[] = {0x00, 0x01, 0x00, 0x10, @@ -459,12 +460,12 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev) struct ni6501_private *devpriv = dev->private; size_t size; - size = usb_endpoint_maxp(devpriv->ep_rx); + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); if (!devpriv->usb_rx_buf) return -ENOMEM; - size = usb_endpoint_maxp(devpriv->ep_tx); + size = max(usb_endpoint_maxp(devpriv->ep_tx), MIN_BUF_SIZE); devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); if (!devpriv->usb_tx_buf) return -ENOMEM; -- 2.17.1