On 25/06/2023 19:12, Zhang Shurong wrote: > Fix potential shift out-of-bounds in max3421_hub_control() > ClearPortFeature handling and SetPortFeature handling. > > wValue may be greater than 32 which can not be used for shifting. You need to use proper name after copying the commit msg... > > similar patch: > https://patchwork.kernel.org/patch/12162547 This does not belong to commit msg, but rather --- . > > Signed-off-by: Zhang Shurong <zhang_shurong@xxxxxxxxxxx> > --- > drivers/usb/host/max3421-hcd.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c > index d152d72de126..035cd6abc2f6 100644 > --- a/drivers/usb/host/max3421-hcd.c > +++ b/drivers/usb/host/max3421-hcd.c > @@ -1688,6 +1688,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, > !pdata->vbus_active_level); > fallthrough; > default: > + if (value >= 32) > + goto error; > max3421_hcd->port_status &= ~(1 << value); > } > break; > @@ -1741,6 +1743,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index, > max3421_reset_port(hcd); > fallthrough; > default: > + if (value >= 32) > + goto error; I am not sure if performing first port reset and then validating the arguments is the correct way. > if ((max3421_hcd->port_status & USB_PORT_STAT_POWER) > != 0) > max3421_hcd->port_status |= (1 << value); Best regards, Krzysztof
