| Message ID | tencent_D1B05B6060451EA10A64A88E122E37EDB508@qq.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | usb: max-3421: fix potential shift out-of-bounds in max3421_hub_control() | expand |
On 25/06/2023 19:12, Zhang Shurong wrote: > Fix potential shift out-of-bounds in max3421_hub_control() > ClearPortFeature handling and SetPortFeature handling. > > wValue may be greater than 32 which can not be used for shifting. You need to use proper name after copying the commit msg... > > similar patch: > https://patchwork.kernel.org/patch/12162547 This does not belong to commit msg, but rather --- . > > Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> > --- > drivers/usb/host/max3421-hcd.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c > index d152d72de126..035cd6abc2f6 100644 > --- a/drivers/usb/host/max3421-hcd.c > +++ b/drivers/usb/host/max3421-hcd.c > @@ -1688,6 +1688,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, > !pdata->vbus_active_level); > fallthrough; > default: > + if (value >= 32) > + goto error; > max3421_hcd->port_status &= ~(1 << value); > } > break; > @@ -1741,6 +1743,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, > max3421_reset_port(hcd); > fallthrough; > default: > + if (value >= 32) > + goto error; I am not sure if performing first port reset and then validating the arguments is the correct way. > if ((max3421_hcd->port_status & USB_PORT_STAT_POWER) > != 0) > max3421_hcd->port_status |= (1 << value); Best regards, Krzysztof
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c index d152d72de126..035cd6abc2f6 100644 --- a/drivers/usb/host/max3421-hcd.c +++ b/drivers/usb/host/max3421-hcd.c @@ -1688,6 +1688,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, !pdata->vbus_active_level); fallthrough; default: + if (value >= 32) + goto error; max3421_hcd->port_status &= ~(1 << value); } break; @@ -1741,6 +1743,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, max3421_reset_port(hcd); fallthrough; default: + if (value >= 32) + goto error; if ((max3421_hcd->port_status & USB_PORT_STAT_POWER) != 0) max3421_hcd->port_status |= (1 << value);
Fix potential shift out-of-bounds in max3421_hub_control() ClearPortFeature handling and SetPortFeature handling. wValue may be greater than 32 which can not be used for shifting. similar patch: https://patchwork.kernel.org/patch/12162547 Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> --- drivers/usb/host/max3421-hcd.c | 4 ++++ 1 file changed, 4 insertions(+)