All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] usb: isp1760: increase buffer size to avoid overflow
@ 2025-04-22 23:00 Alexey V. Vissarionov
  2025-04-23  6:30 ` Fedor Pchelkin
  0 siblings, 1 reply; 7+ messages in thread
From: Alexey V. Vissarionov @ 2025-04-22 23:00 UTC (permalink / raw)
  To: Rui Miguel Silva
  Cc: Alexey V. Vissarionov, Greg Kroah-Hartman, linux-usb, lvc-project

isp1760_field_set() may access the udc->fields array beyond the size
of DC_FIELD_MAX up to HC_FIELD_MAX, which is (now) bigger. Increase
the buffer size to max(DC_FIELD_MAX,HC_FIELD_MAX) to avoid possible
overflow.

Found by ALT Linux Team (altlinux.org) and Linux Verification Center
(linuxtesting.org).

Fixes: 1da9e1c06873 ("usb: isp1760: move to regmap for register access")
Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
---
 drivers/usb/isp1760/isp1760-hcd.h  | 2 +-
 drivers/usb/isp1760/isp1760-regs.h | 2 ++
 drivers/usb/isp1760/isp1760-udc.h  | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/isp1760/isp1760-hcd.h b/drivers/usb/isp1760/isp1760-hcd.h
index ee3063a34de3bccf..a2ba48c84a8dd513 100644
--- a/drivers/usb/isp1760/isp1760-hcd.h
+++ b/drivers/usb/isp1760/isp1760-hcd.h
@@ -50,7 +50,7 @@ struct isp1760_hcd {
 	void __iomem		*base;
 
 	struct regmap		*regs;
-	struct regmap_field	*fields[HC_FIELD_MAX];
+	struct regmap_field	*fields[FIELD_MAX];
 
 	bool			is_isp1763;
 	const struct isp1760_memory_layout	*memory_layout;
diff --git a/drivers/usb/isp1760/isp1760-regs.h b/drivers/usb/isp1760/isp1760-regs.h
index 3a6751197e970013..b4644fc1f88a82f0 100644
--- a/drivers/usb/isp1760/isp1760-regs.h
+++ b/drivers/usb/isp1760/isp1760-regs.h
@@ -267,6 +267,8 @@ enum isp176x_device_controller_fields {
 	DC_FIELD_MAX,
 };
 
+#define	FIELD_MAX	(DC_FIELD_MAX>HC_FIELD_MAX?DC_FIELD_MAX:HC_FIELD_MAX)
+
 /* ISP1763 */
 /* Initialization Registers */
 #define ISP1763_DC_ADDRESS		0x00
diff --git a/drivers/usb/isp1760/isp1760-udc.h b/drivers/usb/isp1760/isp1760-udc.h
index 22044e86bc0ecb84..e01c95161526a3db 100644
--- a/drivers/usb/isp1760/isp1760-udc.h
+++ b/drivers/usb/isp1760/isp1760-udc.h
@@ -69,7 +69,7 @@ struct isp1760_udc {
 	char *irqname;
 
 	struct regmap *regs;
-	struct regmap_field *fields[DC_FIELD_MAX];
+	struct regmap_field *fields[FIELD_MAX];
 
 	struct usb_gadget_driver *driver;
 	struct usb_gadget gadget;


-- 
Alexey V. Vissarionov
gremlin ПРИ altlinux ТЧК org; +vii-cmiii-ccxxix-lxxix-xlii
GPG: 0D92F19E1C0DC36E27F61A29CD17E2B43D879005 @ hkp://keys.gnupg.net

^ permalink raw reply related	[flat|nested] 7+ messages in thread
* Re: [PATCH v1] usb: isp1760: increase buffer size to avoid overflow
@ 2025-04-24 12:59 kernel test robot
  0 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2025-04-24 12:59 UTC (permalink / raw)
  Cc: oe-kbuild-all, llvm

In-Reply-To: <20250423111040.GC857@altlinux.org>
References: <20250423111040.GC857@altlinux.org>
TO: "Alexey V. Vissarionov" <gremlin@altlinux.org>
TO: Rui Miguel Silva <rui.silva@linaro.org>
CC: "Alexey V. Vissarionov" <gremlin@altlinux.org>
CC: Fedor Pchelkin <pchelkin@ispras.ru>
CC: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
CC: linux-usb@vger.kernel.org
CC: lvc-project@linuxtesting.org

Hi Alexey,

kernel test robot noticed the following build warnings:

[auto build test WARNING on usb/usb-testing]
[also build test WARNING on usb/usb-next usb/usb-linus linus/master v6.15-rc3 next-20250424]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Alexey-V-Vissarionov/usb-isp1760-increase-buffer-size-to-avoid-overflow/20250423-191222
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20250423111040.GC857%40altlinux.org
patch subject: [PATCH v1] usb: isp1760: increase buffer size to avoid overflow
config: hexagon-randconfig-002-20250424 (https://download.01.org/0day-ci/archive/20250424/202504242017.ShUkQrcZ-lkp@intel.com/config)
compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project f819f46284f2a79790038e1f6649172789734ae8)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250424/202504242017.ShUkQrcZ-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202504242017.ShUkQrcZ-lkp@intel.com/

All warnings (new ones prefixed by >>):

   In file included from drivers/usb/isp1760/isp1760-if.c:24:
   In file included from drivers/usb/isp1760/isp1760-core.h:21:
>> drivers/usb/isp1760/isp1760-hcd.h:53:30: warning: comparison of different enumeration types ('enum isp176x_device_controller_fields' and 'enum isp176x_host_controller_fields') [-Wenum-compare]
      53 |         struct regmap_field     *fields[DC_HC_FIELD_MAX];
         |                                         ^~~~~~~~~~~~~~~
   drivers/usb/isp1760/isp1760-regs.h:271:16: note: expanded from macro 'DC_HC_FIELD_MAX'
     271 |         (DC_FIELD_MAX > HC_FIELD_MAX ? DC_FIELD_MAX : HC_FIELD_MAX)
         |          ~~~~~~~~~~~~ ^ ~~~~~~~~~~~~
   In file included from drivers/usb/isp1760/isp1760-if.c:24:
   In file included from drivers/usb/isp1760/isp1760-core.h:21:
>> drivers/usb/isp1760/isp1760-hcd.h:53:30: warning: conditional expression between different enumeration types ('enum isp176x_device_controller_fields' and 'enum isp176x_host_controller_fields') [-Wenum-compare-conditional]
      53 |         struct regmap_field     *fields[DC_HC_FIELD_MAX];
         |                                         ^~~~~~~~~~~~~~~
   drivers/usb/isp1760/isp1760-regs.h:271:31: note: expanded from macro 'DC_HC_FIELD_MAX'
     271 |         (DC_FIELD_MAX > HC_FIELD_MAX ? DC_FIELD_MAX : HC_FIELD_MAX)
         |                                      ^ ~~~~~~~~~~~~   ~~~~~~~~~~~~
   In file included from drivers/usb/isp1760/isp1760-if.c:24:
   In file included from drivers/usb/isp1760/isp1760-core.h:22:
>> drivers/usb/isp1760/isp1760-udc.h:72:30: warning: comparison of different enumeration types ('enum isp176x_device_controller_fields' and 'enum isp176x_host_controller_fields') [-Wenum-compare]
      72 |         struct regmap_field *fields[DC_HC_FIELD_MAX];
         |                                     ^~~~~~~~~~~~~~~
   drivers/usb/isp1760/isp1760-regs.h:271:16: note: expanded from macro 'DC_HC_FIELD_MAX'
     271 |         (DC_FIELD_MAX > HC_FIELD_MAX ? DC_FIELD_MAX : HC_FIELD_MAX)
         |          ~~~~~~~~~~~~ ^ ~~~~~~~~~~~~
   In file included from drivers/usb/isp1760/isp1760-if.c:24:
   In file included from drivers/usb/isp1760/isp1760-core.h:22:
>> drivers/usb/isp1760/isp1760-udc.h:72:30: warning: conditional expression between different enumeration types ('enum isp176x_device_controller_fields' and 'enum isp176x_host_controller_fields') [-Wenum-compare-conditional]
      72 |         struct regmap_field *fields[DC_HC_FIELD_MAX];
         |                                     ^~~~~~~~~~~~~~~
   drivers/usb/isp1760/isp1760-regs.h:271:31: note: expanded from macro 'DC_HC_FIELD_MAX'
     271 |         (DC_FIELD_MAX > HC_FIELD_MAX ? DC_FIELD_MAX : HC_FIELD_MAX)
         |                                      ^ ~~~~~~~~~~~~   ~~~~~~~~~~~~
   4 warnings generated.


vim +53 drivers/usb/isp1760/isp1760-hcd.h

    46	
    47	struct isp1760_hcd {
    48		struct usb_hcd		*hcd;
    49	
    50		void __iomem		*base;
    51	
    52		struct regmap		*regs;
  > 53		struct regmap_field	*fields[DC_HC_FIELD_MAX];
    54	
    55		bool			is_isp1763;
    56		const struct isp1760_memory_layout	*memory_layout;
    57	
    58		spinlock_t		lock;
    59		struct isp1760_slotinfo	*atl_slots;
    60		int			atl_done_map;
    61		struct isp1760_slotinfo	*int_slots;
    62		int			int_done_map;
    63		struct isp1760_memory_chunk memory_pool[ISP176x_BLOCK_MAX];
    64		struct list_head	qh_list[QH_END];
    65	
    66		/* periodic schedule support */
    67	#define	DEFAULT_I_TDPS		1024
    68		unsigned		periodic_size;
    69		unsigned		i_thresh;
    70		unsigned long		reset_done;
    71		unsigned long		next_statechange;
    72	};
    73	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2025-04-24 13:00 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-22 23:00 [PATCH] usb: isp1760: increase buffer size to avoid overflow Alexey V. Vissarionov
2025-04-23  6:30 ` Fedor Pchelkin
2025-04-23 11:05   ` Alexey V. Vissarionov
2025-04-23 11:10     ` [PATCH v1] " Alexey V. Vissarionov
2025-04-24  9:15       ` Rui Miguel Silva
2025-04-24 10:04       ` kernel test robot
  -- strict thread matches above, loose matches on Subject: below --
2025-04-24 12:59 kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.