From: Anssi Hannula <anssi.hannula@bitwise.fi>
To: Mathias Nyman <mathias.nyman@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
Date: Tue, 22 Feb 2022 15:41:17 +0200 [thread overview]
Message-ID: <20220222134117.34844-2-anssi.hannula@bitwise.fi> (raw)
In-Reply-To: <20220222134117.34844-1-anssi.hannula@bitwise.fi>
xhci_decode_ctrl_ctx() returns the untouched buffer as-is if both "drop"
and "add" parameters are zero.
Fix the function to return an empty string in that case.
It was not immediately clear from the possible call chains whether this
issue is currently actually triggerable or not.
Note that before 4843b4b5ec64 ("xhci: fix even more unsafe memory usage
in xhci tracing") the result effect in the failure case was different as
a static buffer was used here, but the code still worked incorrectly.
Fixes: 90d6d5731da7 ("xhci: Add tracing for input control context")
Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
---
drivers/usb/host/xhci.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index ac91647195f6..a2fcefb5a0bb 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -2465,6 +2465,8 @@ static inline const char *xhci_decode_ctrl_ctx(char *str,
unsigned int bit;
int ret = 0;
+ str[0] = '\0';
+
if (drop) {
ret = sprintf(str, "Drop:");
for_each_set_bit(bit, &drop, 32)
--
2.34.1
next prev parent reply other threads:[~2022-02-22 13:52 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-22 13:41 [PATCH 1/2] xhci: fix garbage USBSTS being logged in some cases Anssi Hannula
2022-02-22 13:41 ` Anssi Hannula [this message]
2022-02-23 8:56 ` Mathias Nyman
2022-02-25 10:26 ` [PATCH 1/2 v2] " Anssi Hannula
2022-02-28 11:34 ` Mathias Nyman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220222134117.34844-2-anssi.hannula@bitwise.fi \
--to=anssi.hannula@bitwise.fi \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mathias.nyman@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®