From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Robin Guo <guoweibin@inspur.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
b-liu@ti.com, linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 17/27] usb: musb: Fix musb_gadget.c rxstate overflow bug
Date: Wed, 12 Oct 2022 20:24:49 -0400 [thread overview]
Message-ID: <20221013002501.1895204-17-sashal@kernel.org> (raw)
In-Reply-To: <20221013002501.1895204-1-sashal@kernel.org>
From: Robin Guo <guoweibin@inspur.com>
[ Upstream commit eea4c860c3b366369eff0489d94ee4f0571d467d ]
The usb function device call musb_gadget_queue() adds the passed
request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz)
and (is_buffer_mapped(req) return false),the rxstate() will copy all data
in fifo to request->buf which may cause request->buf out of bounds.
Fix it by add the length check :
fifocnt = min_t(unsigned, request->length - request->actual, fifocnt);
Signed-off-by: Robin Guo <guoweibin@inspur.com>
Link: https://lore.kernel.org/r/20220906102119.1b071d07a8391ff115e6d1ef@inspur.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/musb/musb_gadget.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 4622400ba4dd..8e83995fc3bd 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -760,6 +760,9 @@ static void rxstate(struct musb *musb, struct musb_request *req)
musb_writew(epio, MUSB_RXCSR, csr);
buffer_aint_mapped:
+ fifo_count = min_t(unsigned int,
+ request->length - request->actual,
+ (unsigned int)fifo_count);
musb_read_fifo(musb_ep->hw_ep, fifo_count, (u8 *)
(request->buf + request->actual));
request->actual += fifo_count;
--
2.35.1
next prev parent reply other threads:[~2022-10-13 0:32 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-13 0:24 [PATCH AUTOSEL 5.4 01/27] clk: zynqmp: Fix stack-out-of-bounds in strncpy` Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 02/27] media: cx88: Fix a null-ptr-deref bug in buffer_prepare() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 03/27] clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 04/27] scsi: 3w-9xxx: Avoid disabling device if failing to enable it Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 05/27] nbd: Fix hung when signal interrupts nbd_start_device_ioctl() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 06/27] staging: rtl8712: Fix return type for implementation of ndo_start_xmit Sasha Levin
2022-10-13 5:55 ` Greg Kroah-Hartman
2022-10-13 17:51 ` Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 07/27] staging: rtl8192e: " Sasha Levin
2022-10-13 5:55 ` Greg Kroah-Hartman
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 08/27] power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 09/27] staging: vt6655: fix potential memory leak Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 10/27] ata: libahci_platform: Sanity check the DT child nodes number Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 11/27] bcache: fix set_at_max_writeback_rate() for multiple attached devices Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 12/27] hid: topre: Add driver fixing report descriptor Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 13/27] HID: roccat: Fix use-after-free in roccat_read() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 14/27] HSI: ssi_protocol: fix potential resource leak in ssip_pn_open() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 15/27] md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 16/27] usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() Sasha Levin
2022-10-13 0:24 ` Sasha Levin [this message]
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 18/27] Revert "usb: storage: Add quirk for Samsung Fit flash" Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 19/27] staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 20/27] staging: rtl8192u: Fix return type of ieee80211_xmit Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 21/27] staging: octeon: Fix return type of cvm_oct_xmit and cvm_oct_xmit_pow Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 22/27] nvme: copy firmware_rev on each init Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 23/27] nvmet-tcp: add bounds check on Transfer Tag Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 24/27] usb: idmouse: fix an uninit-value in idmouse_open Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 25/27] fsi: master-ast-cf: Fix missing of_node_put in fsi_master_acf_probe Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 26/27] sbitmap: fix lockup while swapping Sasha Levin
2022-10-13 0:24 ` [PATCH AUTOSEL 5.4 27/27] clk: bcm2835: Make peripheral PLLC critical Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221013002501.1895204-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=b-liu@ti.com \
--cc=gregkh@linuxfoundation.org \
--cc=guoweibin@inspur.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox