Re: [PATCH] USB: serial: io_edgeport: cap received transmit credits

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Tue, Jul 14, 2026 at 06:34:24PM +0900, Sunho Park wrote:
> The interrupt-status packet reports transmit credits returned by the
> device. edge_interrupt_callback() adds the 16-bit value to txCredits
> without checking maxTxCredits.
> 
> edge_write() uses txCredits minus the software FIFO count as the amount
> of data that fits. Since the FIFO is allocated with maxTxCredits bytes,
> txCredits exceeding maxTxCredits can cause OOB write in ring buffer.
> 
> Cap accumulated credits at maxTxCredits. Conforming devices should never
> hit the cap.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Sunho Park <shpark061104@gmail.com>
> ---
>  drivers/usb/serial/io_edgeport.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
> index 34ccf7820537..503b3b5bb647 100644
> --- a/drivers/usb/serial/io_edgeport.c
> +++ b/drivers/usb/serial/io_edgeport.c
> @@ -646,7 +646,10 @@ static void edge_interrupt_callback(struct urb *urb)
>  				if (edge_port && edge_port->open) {
>  					spin_lock_irqsave(&edge_port->ep_lock,
>  							  flags);
> -					edge_port->txCredits += txCredits;
> +					edge_port->txCredits =
> +						min_t(unsigned int,

LLMs really love to use min_t() as they haven't been trained on modern
kernel code.

Please don't use it, it shouldn't be needed here, right?

thanks,

greg k-h