Skip to contentSkip to conversation

USB: ehci_brcm_hub_control: filter out invalid port index

PATCH In review Haimin Zhang 3 participants 3 messages Nov 11, 2021

Subsystems (3)
USB USB ehci driver Broadcom brcmstb USB ehci driver
lore
Share & tools
lore

Haimin Zhang

author
#0 lore raw

PATCH v2 1/1 USB: ehci_brcm_hub_control: filter out invalid port index

Due to (wIndex & 0xff) - 1 can get an integer greater than 0xf, this can cause array index to be out of bounds since the size of array port_status is 0xf. Remove cases greater than 0xf, because such cases are meaningless. It is reasonable to return -EPIPE, the caller rh_call_control will check the return value and handle it properly. The callee ehci_hub_control also doesn't need to deal with situations greater than 0xf. The size of the array port_status determines that such situations should not be handled.

Reported-by TCS Robot <[email protected]>
Signed-off-by Haimin Zhang <[email protected]>
---
 drivers/usb/host/ehci-brcm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/ehci-brcm.c +3 -1
index d3626bfa966b..07e6df336a08 100644
@@ -63,6 +63,9 @@ static int ehci_brcm_hub_control(
 	unsigned long flags;
 	int retval, irq_disabled = 0;
 
+	if (!wIndex || wIndex > ports)
+		return -EPIPE;
+
 	status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
 
 	/*

@@ -70,7 +73,6 @@ static int ehci_brcm_hub_control(
 	 * of RESUME
 	 */
 	if ((typeReq == GetPortStatus) &&
-	    (wIndex && wIndex <= ports) &&
 	    ehci->reset_done[wIndex-1] &&
 	    time_after_eq(jiffies, ehci->reset_done[wIndex-1]) &&
 	    (ehci_readl(ehci, status_reg) & PORT_RESUME)) {
Signature · 1 line
2.30.1 (Apple Git-130)
maintainer
#1 lore raw
Quoted 40 lines · Haimin Zhang

Due to (wIndex & 0xff) - 1 can get an integer greater than 0xf, this can cause array index to be out of bounds since the size of array port_status is 0xf. Remove cases greater than 0xf, because such cases are meaningless. It is reasonable to return -EPIPE, the caller rh_call_control will check the return value and handle it properly. The callee ehci_hub_control also doesn't need to deal with situations greater than 0xf. The size of the array port_status determines that such situations should not be handled.

Reported-by TCS Robot <[email protected]>
Signed-off-by Haimin Zhang <[email protected]>
---
 drivers/usb/host/ehci-brcm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/ehci-brcm.c +3 -1
index d3626bfa966b..07e6df336a08 100644
@@ -63,6 +63,9 @@ static int ehci_brcm_hub_control(
 	unsigned long flags;
 	int retval, irq_disabled = 0;
 
+	if (!wIndex || wIndex > ports)
+		return -EPIPE;
+
 	status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
 
 	/*

@@ -70,7 +73,6 @@ static int ehci_brcm_hub_control(
 	 * of RESUME
 	 */
 	if ((typeReq == GetPortStatus) &&
-	    (wIndex && wIndex <= ports) &&
 	    ehci->reset_done[wIndex-1] &&
 	    time_after_eq(jiffies, ehci->reset_done[wIndex-1]) &&
 	    (ehci_readl(ehci, status_reg) & PORT_RESUME)) {
Signature · 1 line
2.30.1 (Apple Git-130)

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him a patch that has triggered this response. He used to manually respond to these common problems, but in order to save his sanity (he kept writing the same thing over and over, yet to different people), I was created. Hopefully you will not take offence and will fix the problem in your patch and resubmit it so that it can be accepted into the Linux kernel tree.

You are receiving this message because of the following common error(s) as indicated below:

- This looks like a new version of a previously submitted patch, but you did not list below the --- line any changes from the previous version. Please read the section entitled "The canonical patch format" in the kernel file, Documentation/SubmittingPatches for what needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about how to resolve this issue, please feel free to respond to this email and Greg will reply once he has dug out from the pending patches received from other developers.

thanks,

greg k-h's patch email bot

maintainer
#2 lore raw
In reply to Haimin Zhang
Quoted 20 lines · Haimin Zhang

Due to (wIndex & 0xff) - 1 can get an integer greater than 0xf, this can cause array index to be out of bounds since the size of array port_status is 0xf. Remove cases greater than 0xf, because such cases are meaningless. It is reasonable to return -EPIPE, the caller rh_call_control will check the return value and handle it properly. The callee ehci_hub_control also doesn't need to deal with situations greater than 0xf. The size of the array port_status determines that such situations should not be handled.

Reported-by TCS Robot <[email protected]>
Signed-off-by Haimin Zhang <[email protected]>
---
 drivers/usb/host/ehci-brcm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/ehci-brcm.c +0 -0
index d3626bfa966b..07e6df336a08 100644

drivers/usb/host/ehci-brcm.c static int ehci_brcm_hub_control( · line 67

Quoted 5 lines
drivers/usb/host/ehci-brcm.c +2 -0
@@ -63,6 +63,9 @@ static int ehci_brcm_hub_control(
 	unsigned long flags;
 	int retval, irq_disabled = 0;
 
+	if (!wIndex || wIndex > ports)
+		return -EPIPE;

This is just like your original version of the patch. It won't work right if wIndex is equal to 0x0101, for instance.

Alan Stern

Quoted 15 lines
drivers/usb/host/ehci-brcm.c +1 -1
+
 	status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
 
 	/*

@@ -70,7 +73,6 @@ static int ehci_brcm_hub_control(
 	 * of RESUME
 	 */
 	if ((typeReq == GetPortStatus) &&
-	    (wIndex && wIndex <= ports) &&
 	    ehci->reset_done[wIndex-1] &&
 	    time_after_eq(jiffies, ehci->reset_done[wIndex-1]) &&
 	    (ehci_readl(ehci, status_reg) & PORT_RESUME)) {
Signature · 1 line
2.30.1 (Apple Git-130)