* [PATCH] usb: appledisplay: validate interrupt report length
@ 2026-08-30 14:24 Pengpeng Hou
2026-08-31 10:45 ` Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Pengpeng Hou @ 2026-08-30 14:24 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Pengpeng Hou, linux-usb, linux-kernel
A successful interrupt URB completion can still carry fewer bytes than the
two-byte report consumed by appledisplay_complete(). The callback
unconditionally reads urbdata[1].
Resubmit short successful reports without parsing them.
Fixes: 069e8a65cd79 ("[PATCH] Driver for Apple Cinema Display")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/usb/misc/appledisplay.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index 16883592f7fc6..4543545793e27 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -82,6 +82,8 @@ static void appledisplay_complete(struct urb *urb)
switch (status) {
case 0:
/* success */
+ if (urb->actual_length < ACD_URB_BUFFER_LEN)
+ goto exit;
break;
case -EOVERFLOW:
dev_err(dev,
base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
--
2.50.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] usb: appledisplay: validate interrupt report length
2026-08-30 14:24 [PATCH] usb: appledisplay: validate interrupt report length Pengpeng Hou
@ 2026-08-31 10:45 ` Greg Kroah-Hartman
0 siblings, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2026-08-31 10:45 UTC (permalink / raw)
To: Pengpeng Hou; +Cc: linux-usb, linux-kernel
On Sun, Aug 30, 2026 at 10:24:06PM +0800, Pengpeng Hou wrote:
> A successful interrupt URB completion can still carry fewer bytes than the
> two-byte report consumed by appledisplay_complete(). The callback
> unconditionally reads urbdata[1].
>
> Resubmit short successful reports without parsing them.
>
> Fixes: 069e8a65cd79 ("[PATCH] Driver for Apple Cinema Display")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/usb/misc/appledisplay.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
> index 16883592f7fc6..4543545793e27 100644
> --- a/drivers/usb/misc/appledisplay.c
> +++ b/drivers/usb/misc/appledisplay.c
> @@ -82,6 +82,8 @@ static void appledisplay_complete(struct urb *urb)
> switch (status) {
> case 0:
> /* success */
> + if (urb->actual_length < ACD_URB_BUFFER_LEN)
> + goto exit;
This should go above the comment, right?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-31 10:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-30 14:24 [PATCH] usb: appledisplay: validate interrupt report length Pengpeng Hou
2026-08-31 10:45 ` Greg Kroah-Hartman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox