From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 077A7C001B0 for ; Tue, 11 Jul 2023 09:42:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230175AbjGKJmC (ORCPT ); Tue, 11 Jul 2023 05:42:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229990AbjGKJmA (ORCPT ); Tue, 11 Jul 2023 05:42:00 -0400 Received: from relay7-d.mail.gandi.net (relay7-d.mail.gandi.net [IPv6:2001:4b98:dc4:8::227]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A3E691; Tue, 11 Jul 2023 02:41:59 -0700 (PDT) Received: by mail.gandi.net (Postfix) with ESMTPSA id 6C38D20008; Tue, 11 Jul 2023 09:41:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1689068517; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1mQpjvbXTqSZMh2oqXJLwIPvBh65UpQSNz+TWmuX7pg=; b=J0IPQRNMF4rW2vhHO+MYH6DbHjXzguu5d4CblnTphTAbz9ZHmZ8RKYVpLXShsypPVO7j6N LYIc1MsuzN/0rKV95AwKrjMPziCl43osWurZYVBCqlwo2TdBB8aEX5PQTCS5AGn50ZwmVL NTk/4ViLGUGU5qLaKuzX8Ib9PeofopHsvXevdHx5GDuHYF0bvSswTu9giUyFQtqS/YpbaK FvIou48O/Tbv0p4Kuv01/RRyikSfEnqANaZHaheeak+lCFg1RslpA9s4A6rqxdFdALqKXN FgIQbgkJJ+fVrlUVqyoL8iUiKDvvHr+9Xgt6QwIxvaipNaeSZgstvccv138LAg== Date: Tue, 11 Jul 2023 11:41:55 +0200 From: Herve Codina To: "Chunfeng Yun (=?UTF-8?B?5LqR5pil5bOw?=)" Cc: "yhao016@ucr.edu" , "linux-arm-kernel@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "linux-mediatek@lists.infradead.org" , "gregkh@linuxfoundation.org" , "linux-usb@vger.kernel.org" Subject: Re: [PATCH] usb: mtu3: Fix possible use-before-initialization bug Message-ID: <20230711114155.4a000704@bootlin.com> In-Reply-To: <29a71cbb61148d2085cc08da681526c4e20d31b9.camel@mediatek.com> References: <20230705080625.02b2bac5@bootlin.com> <20230710082558.2f82d607@bootlin.com> <29a71cbb61148d2085cc08da681526c4e20d31b9.camel@mediatek.com> Organization: Bootlin X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-GND-Sasl: herve.codina@bootlin.com Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Hi Chunfeng, On Tue, 11 Jul 2023 08:48:35 +0000 Chunfeng Yun (云春峰) wrote: > On Mon, 2023-07-10 at 08:25 +0200, Herve Codina wrote: > > > > External email : Please do not click links or open attachments until > > you have verified the sender or the content. > > Hi Yu, > > > > On Sun, 9 Jul 2023 17:48:15 -0700 > > Yu Hao wrote: > > > > > Hi Hervé, > > > > > > Thanks for the comments. How about this patch? > > > --- > > > drivers/usb/mtu3/mtu3_gadget_ep0.c | 11 ++++++++--- > > > 1 file changed, 8 insertions(+), 3 deletions(-) > > > > > > diff --git a/drivers/usb/mtu3/mtu3_gadget_ep0.c > > > b/drivers/usb/mtu3/mtu3_gadget_ep0.c > > > index e4fd1bb14a55..af2884943c2a 100644 > > > --- a/drivers/usb/mtu3/mtu3_gadget_ep0.c > > > +++ b/drivers/usb/mtu3/mtu3_gadget_ep0.c > > > @@ -600,7 +600,7 @@ static void ep0_tx_state(struct mtu3 *mtu) > > > mtu3_readl(mtu->mac_base, U3D_EP0CSR)); > > > } > > > > > > -static void ep0_read_setup(struct mtu3 *mtu, struct > > usb_ctrlrequest *setup) > > > +static int ep0_read_setup(struct mtu3 *mtu, struct usb_ctrlrequest > > *setup) > > > { > > > struct mtu3_request *mreq; > > > u32 count; > > > @@ -608,6 +608,8 @@ static void ep0_read_setup(struct mtu3 *mtu, > > > struct usb_ctrlrequest *setup) > > > > > > csr = mtu3_readl(mtu->mac_base, U3D_EP0CSR) & EP0_W1C_BITS; > > > count = mtu3_readl(mtu->mac_base, U3D_RXCOUNT0); > > > + if (count == 0) > > > + return -EINVAL; > > > > 'count' should be tested against sizeof(*setup). Indeed, we need to > > have a > > setup data packet in the fifo. > > > > What do you think about: > > if (count < sizef(*setup)) > > return -EINVAL; > before call this function, already check the data length in fifo, it > should be 8 bytes. > see mtu3_ep0_isr(), about line 761. Indeed, I missed that point. Thanks for pointing it. Regards, Hervé > > I think no need this patch > > Thanks a lot > > > > > > > > > ep0_read_fifo(mtu->ep0, (u8 *)setup, count); > > > > > > @@ -642,7 +644,8 @@ __acquires(mtu->lock) > > > struct mtu3_request *mreq; > > > int handled = 0; > > > > > > - ep0_read_setup(mtu, &setup); > > > + if (ep0_read_setup(mtu, &setup)) > > > + return -EINVAL; > > > > Forward the error code to the caller ? > > > > ret = ep0_read_setup(mtu, &setup) > > if (ret < 0) > > return ret; > > > > > > > trace_mtu3_handle_setup(&setup); > > > > > > if ((setup.bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) > > > @@ -764,7 +767,9 @@ irqreturn_t mtu3_ep0_isr(struct mtu3 *mtu) > > > break; > > > } > > > > > > - ep0_handle_setup(mtu); > > > + if (ep0_handle_setup(mtu)) > > > + break; > > > + > > > > Ok > > > > > ret = IRQ_HANDLED; > > > break; > > > default: > > > > Be careful, your patch is wrongly indented. > > tabs replaced by 4 spaces. You need to keep tabs. > > > > Regards, > > Hervé Codina > >