Messages in this thread | ![/](/images/icornerl.gif) | | Date | Mon, 26 Jun 2023 08:16:06 +0200 | Subject | Re: [PATCH] usb: max-3421: fix potential shift out-of-bounds in max3421_hub_control() | From | Krzysztof Kozlowski <> |
| |
On 25/06/2023 19:12, Zhang Shurong wrote: > Fix potential shift out-of-bounds in max3421_hub_control() > ClearPortFeature handling and SetPortFeature handling. > > wValue may be greater than 32 which can not be used for shifting.
You need to use proper name after copying the commit msg...
> > similar patch: > https://patchwork.kernel.org/patch/12162547
This does not belong to commit msg, but rather --- .
> > Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> > --- > drivers/usb/host/max3421-hcd.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c > index d152d72de126..035cd6abc2f6 100644 > --- a/drivers/usb/host/max3421-hcd.c > +++ b/drivers/usb/host/max3421-hcd.c > @@ -1688,6 +1688,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, > !pdata->vbus_active_level); > fallthrough; > default: > + if (value >= 32) > + goto error; > max3421_hcd->port_status &= ~(1 << value); > } > break; > @@ -1741,6 +1743,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, > max3421_reset_port(hcd); > fallthrough; > default: > + if (value >= 32) > + goto error;
I am not sure if performing first port reset and then validating the arguments is the correct way.
> if ((max3421_hcd->port_status & USB_PORT_STAT_POWER) > != 0) > max3421_hcd->port_status |= (1 << value);
Best regards, Krzysztof
| ![\](/images/icornerr.gif) |