Re: [PATCH v1] usb: hcd: out of bounds access in for_each_companion

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 29 Feb 2016, Robert Dobrowolski wrote:

> On BXT platform Host Controller and Device Controller figure as
> same PCI device but with different device function. HCD should not
> pass data to Device Controller. Checking if companion device is
> Device Controller and omitting it.
> 
> Signed-off-by: Robert Dobrowolski <robert.dobrowolski@xxxxxxxxx>
> ---
>  drivers/usb/core/hcd-pci.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
> index 9eb1cff..ae977d7 100644
> --- a/drivers/usb/core/hcd-pci.c
> +++ b/drivers/usb/core/hcd-pci.c
> @@ -74,6 +74,16 @@ static void for_each_companion(struct pci_dev *pdev, struct usb_hcd *hcd,
>  		if (companion->bus != pdev->bus ||
>  				PCI_SLOT(companion->devfn) != slot)
>  			continue;
> +
> +		/*
> +		 * On certain platforms Host Controller and Device Controller
> +		 * figure as same device with different device function. HCD
> +		 * should not pass data to Device Controller. Checking if
> +		 * companion device is Device Controller and omitting it.
> +		 */
> +		if (companion->class == ((PCI_CLASS_SERIAL_USB << 8) | 0xfe))
> +			continue;
> +
>  		companion_hcd = pci_get_drvdata(companion);
>  		if (!companion_hcd || !companion_hcd->self.root_hub)
>  			continue;

This cries out for a #define.

Besides, wouldn't it be safer to check that the class _is_ equal to 
CL_UHCI, CL_OHCI, or CL_EHCI instead of checking what the class 
_isn't_ equal to?  What if somebody puts a non-USB function in the same 
slot?

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux