Re: [PATCH] usb: cdns3: fix possible buffer overflow caused by bad DMA value

On 20-07-01 09:52:43, Felipe Balbi wrote: > Peter Chen writes: > > > On 20-05-30 11:24:00, Jia-Ju Bai wrote: > >> In cdns3_ep0_setup_phase(): > >> struct usb_ctrlrequest *ctrl = priv_dev->setup_buf; > >> > >> Because priv_dev->setup_buf (allocated in cdns3_gadget_start) is stored > >> in DMA

Re: [PATCH] usb: cdns3: fix possible buffer overflow caused by bad DMA value

Peter Chen writes: > On 20-05-30 11:24:00, Jia-Ju Bai wrote: >> In cdns3_ep0_setup_phase(): >> struct usb_ctrlrequest *ctrl = priv_dev->setup_buf; >> >> Because priv_dev->setup_buf (allocated in cdns3_gadget_start) is stored >> in DMA memory, and thus ctrl is a DMA value. >> >>

Re: [PATCH] usb: cdns3: fix possible buffer overflow caused by bad DMA value

On 20-05-30 11:24:00, Jia-Ju Bai wrote: > In cdns3_ep0_setup_phase(): > struct usb_ctrlrequest *ctrl = priv_dev->setup_buf; > > Because priv_dev->setup_buf (allocated in cdns3_gadget_start) is stored > in DMA memory, and thus ctrl is a DMA value. > > cdns3_ep0_setup_phase() >

Re: [PATCH] usb: cdns3: fix possible buffer overflow caused by bad DMA value

> To fix these possible bugs, index is checked before being used. How do you think about a wording variant like the following? Thus check the index before using it further. Would you like to add the tag “Fixes” to the commit message? Regards, Markus

[PATCH] usb: cdns3: fix possible buffer overflow caused by bad DMA value

In cdns3_ep0_setup_phase(): struct usb_ctrlrequest *ctrl = priv_dev->setup_buf; Because priv_dev->setup_buf (allocated in cdns3_gadget_start) is stored in DMA memory, and thus ctrl is a DMA value. cdns3_ep0_setup_phase() cdns3_ep0_standard_request(priv_dev, ctrl)