| Message ID | 200f38d3e3eb44ec8ec8f8e9f210f131@inspur.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems | expand |
On Wed, Jul 27, 2022 at 08:43:34AM +0000, Andy Guo (郭卫斌) wrote: > From: guoweibin <guoweibin@inspur.com> Your From: in your email has your real name, why not use that instead of just putting your email alias here? > > when the rxstate function executes the 'goto buffer_aint_mapped' code > branch, it will always copy the fifocnt bytes data to request->buf, > which may cause request->buf out of bounds. for Ethernet-over-USB will > cause skb_over_panic when a packet larger than mtu is recived. How can we get a bigger packet than mtu? > > Fix it by add the length check : > fifocnt = min_t(unsigned, request->length - request->actual, fifocnt); > > Signed-off-by: guoweibin <guoweibin@inspur.com> Same here. > --- > v2: > -fix format error > drivers/usb/musb/musb_gadget.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c > index 51274b87f46c..4ad5a1f31d7e 100644 > --- a/drivers/usb/musb/musb_gadget.c > +++ b/drivers/usb/musb/musb_gadget.c > @@ -760,6 +760,7 @@ static void rxstate(struct musb *musb, struct musb_request *req) > musb_writew(epio, MUSB_RXCSR, csr); > > buffer_aint_mapped: > + fifo_count = min_t(unsigned, request->length - request->actual, fifo_count); Why the case to "unsigned"? And if we get a too big packet, shouldn't we drop it? And what does this have to do with a usb-ethernet device, this is in the generic musb code, not an ethernet driver. thanks, greg k-h
On Thu, Jul 28, 2022 at 01:14:17AM +0000, Andy Guo (郭卫斌) wrote: As can be seen in the archives: https://lore.kernel.org/all/2c234d13d7274763b0102b83ce65b8ff@inspur.com/ this message could not be decoded, sorry. Please resend in plain text format. thanks, greg k-h
I'm sorroy,
I use Enterprise mailbox doesn't work very well.
I will send this patch through another mailbox.
Thanks
guoweibin
-----Original Message-----
From: gregkh@linuxfoundation.org <gregkh@linuxfoundation.org>
Sent: Thursday, July 28, 2022 2:57 PM
To: Andy Guo (郭卫斌) <guoweibin@inspur.com>
Cc: b-liu@ti.com; linux-usb@vger.kernel.org; linux-kernel@vger.kernel.org
Subject: Re: 答复: [vger.kernel.org代发]Re: [PATCH v2] usb: musb: Fix musb_gadget.c rxstate may cause request->buf overflow problems
On Thu, Jul 28, 2022 at 01:14:17AM +0000, Andy Guo (郭卫斌) wrote:
As can be seen in the archives:
https://lore.kernel.org/all/2c234d13d7274763b0102b83ce65b8ff@inspur.com/
this message could not be decoded, sorry.
Please resend in plain text format.
thanks,
greg k-h
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index 51274b87f46c..4ad5a1f31d7e 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -760,6 +760,7 @@ static void rxstate(struct musb *musb, struct musb_request *req) musb_writew(epio, MUSB_RXCSR, csr); buffer_aint_mapped: + fifo_count = min_t(unsigned, request->length - request->actual, fifo_count); musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *) (request->buf + request->actual)); request->actual += fifo_count;