[lvc-project] [PATCH] usb: isp1760: increase buffer size to avoid overflow

[Fedor Pchelkin]

On Wed, 23. Apr 02:00, Alexey V. Vissarionov wrote:
> isp1760_field_set() may access the udc->fields array beyond the size
> of DC_FIELD_MAX up to HC_FIELD_MAX, which is (now) bigger. Increase
> the buffer size to max(DC_FIELD_MAX,HC_FIELD_MAX) to avoid possible
> overflow.

Where exactly does the problem manifest? There is no comprehensible bug
description here from you..

Though I guess isp1760_set_pullup() call site is concerned?

> @@ -267,6 +267,8 @@ enum isp176x_device_controller_fields {
>  	DC_FIELD_MAX,
>  };
>  
> +#define	FIELD_MAX	(DC_FIELD_MAX>HC_FIELD_MAX?DC_FIELD_MAX:HC_FIELD_MAX)
> +

Please make sure to run your changes through checkpatch.pl and the
compiler first. They are both not happy at the moment.


In file included from drivers/usb/isp1760/isp1760-hcd.h:8,
                 from drivers/usb/isp1760/isp1760-core.h:21,
                 from drivers/usb/isp1760/isp1760-core.c:24:
drivers/usb/isp1760/isp1760-regs.h:270:9: warning: ‘FIELD_MAX’ redefined
  270 | #define FIELD_MAX       (DC_FIELD_MAX>HC_FIELD_MAX?DC_FIELD_MAX:HC_FIELD_MAX)
      |         ^~~~~~~~~
In file included from ./include/linux/fortify-string.h:5,
                 from ./include/linux/string.h:392,
                 from ./include/linux/bitmap.h:13,
                 from ./include/linux/cpumask.h:12,
                 from ./arch/x86/include/asm/tlbbatch.h:5,
                 from ./include/linux/mm_types_task.h:17,
                 from ./include/linux/sched.h:38,
                 from ./include/linux/delay.h:13,
                 from drivers/usb/isp1760/isp1760-core.c:15:
./include/linux/bitfield.h:86:9: note: this is the location of the previous definition
   86 | #define FIELD_MAX(_mask)                                                \
      |         ^~~~~~~~~
drivers/usb/isp1760/isp1760-regs.h:270:38: warning: comparison between ‘enum isp176x_device_controller_fields’ and ‘enum isp176x_host_controller_fields’ [-Wenum-compare]
  270 | #define FIELD_MAX       (DC_FIELD_MAX>HC_FIELD_MAX?DC_FIELD_MAX:HC_FIELD_MAX)
      |                                      ^
drivers/usb/isp1760/isp1760-hcd.h:53:41: note: in expansion of macro ‘FIELD_MAX’
   53 |         struct regmap_field     *fields[FIELD_MAX];
      |                                         ^~~~~~~~~
drivers/usb/isp1760/isp1760-regs.h:270:38: warning: comparison between ‘enum isp176x_device_controller_fields’ and ‘enum isp176x_host_controller_fields’ [-Wenum-compare]
  270 | #define FIELD_MAX       (DC_FIELD_MAX>HC_FIELD_MAX?DC_FIELD_MAX:HC_FIELD_MAX)
      |                                      ^
drivers/usb/isp1760/isp1760-udc.h:72:37: note: in expansion of macro ‘FIELD_MAX’
   72 |         struct regmap_field *fields[FIELD_MAX];
      |                                     ^~~~~~~~~


Thanks!