Skip to contentSkip to conversation

mfd: dln2: add a limit check for invalid "echo"

PATCH In review Dan Carpenter 2 participants 2 messages Nov 13, 2014

Subsystems (2)
Kernel janitors Multifunction devices (MFD)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/2 mfd: dln2: add a limit check for invalid "echo"

We check the other variables and traditionally we don't trust data from USB devices so adding a check here is normal. This silences a static checker warning.

Signed-off-by Dan Carpenter <[email protected]>

---
I am unsure if this fix is correct and I don't have the hardware. Please review this one carefully. The "goto out;" seems to use the invalid data and I don't understand why.

drivers/mfd/dln2.c +5 -0
index 9765a17..3101e5e 100644
@@ -280,6 +280,11 @@ static void dln2_rx(struct urb *urb)
 		goto out;
 	}
 
+	if (echo >= DLN2_MAX_RX_SLOTS) {
+		dev_warn(dev, "invalid echo %d\n", echo);
+		goto out;
+	}
+
 	data = urb->transfer_buffer + sizeof(struct dln2_header);
 	len = urb->actual_length - sizeof(struct dln2_header);
#1 lore raw
Quoted 16 lines · Dan Carpenter

We check the other variables and traditionally we don't trust data from USB devices so adding a check here is normal. This silences a static checker warning.

Signed-off-by Dan Carpenter <[email protected]>

---
I am unsure if this fix is correct and I don't have the hardware. Please review this one carefully. The "goto out;" seems to use the invalid data and I don't understand why.

drivers/mfd/dln2.c +0 -0
index 9765a17..3101e5e 100644
@@ -280,6 +280,11 @@ static void dln2_rx(struct urb *urb)
                goto out;

drivers/mfd/dln2.c static void dln2_rx(struct urb *urb) · line 290

Quoted 10 lines
drivers/mfd/dln2.c +5 -0
        }
 
+       if (echo >= DLN2_MAX_RX_SLOTS) {
+               dev_warn(dev, "invalid echo %d\n", echo);
+               goto out;
+       }
+
        data = urb->transfer_buffer + sizeof(struct dln2_header);
        len = urb->actual_length - sizeof(struct dln2_header);

Hi Dan,

Thanks for the patch. You are right that we need to check echo, but only in the case that it is not an event. In that case the echo counter increments for every event and can easily be greater the DLN2_MAX_RX_SLOTS. So the correct patch is to check in dln2_transfer_complete() that rx_slot is valid. I will follow-up with a patch for that shortly.