linux-kernel - Re: [PATCH 3/3] usb: aspeed-vhub: fix ep0 OUT ack received wrong length issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <12cf11dc4326922ceb67ede7b63a53fe1840b6fd.camel@kernel.crashing.org>
Date:   Tue, 30 Nov 2021 10:48:48 +1100
From:   Benjamin Herrenschmidt <benh@...nel.crashing.org>
To:     Neal Liu <neal_liu@...eedtech.com>,
        Felipe Balbi <balbi@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Joel Stanley <joel@....id.au>,
        Andrew Jeffery <andrew@...id.au>,
        Cai Huoqing <caihuoqing@...du.com>,
        Tao Ren <rentao.bupt@...il.com>,
        Julia Lawall <julia.lawall@...ia.fr>,
        kernel test robot <lkp@...el.com>,
        Sasha Levin <sashal@...nel.org>, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-aspeed@...ts.ozlabs.org
Cc:     BMC-SW@...eedtech.com
Subject: Re: [PATCH 3/3] usb: aspeed-vhub: fix ep0 OUT ack received wrong
 length issue

On Fri, 2021-11-26 at 19:09 +0800, Neal Liu wrote:
> 
> diff --git a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
> b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
> index 74ea36c19b1e..bea9cbb191a2 100644
> --- a/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
> +++ b/drivers/usb/gadget/udc/aspeed-vhub/ep0.c
> @@ -251,6 +251,13 @@ static void ast_vhub_ep0_do_receive(struct
> ast_vhub_ep *ep, struct ast_vhub_req
>  		len = remain;
>  		rc = -EOVERFLOW;
>  	}
> +
> +	/* HW return wrong data len */
> +	if (len < ep->ep.maxpacket && len != remain) {
> +		EPDBG(ep, "using expected data len instead\n");
> +		len = remain;
> +	}
> +

Wow, that is a nasty hw bug ! Patch looks good, I had to swap some of
that logic back into my brain but it looks like it won't break any
normal case :-)

Acked-by: Benjamin Herrenschmidt <benh@...nel.crashing.org>

Cheers,
Ben.