linux-kernel - Re:[PATCH] usb: storage: Fix `us->iobuf` size for BOT transmission to prevent memory overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <814316b6-013b-4735-995d-b6c0c616c71b@rowland.harvard.edu>
Date: Thu, 13 Mar 2025 10:36:32 -0400
From: Alan Stern <stern@...land.harvard.edu>
To: daixin_tkzc <daixin_tkzc@....com>
Cc: Greg KH <gregkh@...uxfoundation.org>,
	matthew dharm <mdharm-usb@...-eyed-alien.net>,
	linux-usb@...r.kernel.org, usb-storage@...ts.one-eyed-alien.net,
	linux-kernel@...r.kernel.org
Subject: Re:[PATCH] usb: storage: Fix `us->iobuf` size for BOT transmission
 to prevent memory overflow

On Thu, Mar 13, 2025 at 08:12:20PM +0800, daixin_tkzc wrote:
> Thank you for reviewing my patch.
> 
> 
> I'm sorry I just responded individually.
> 
> 
> Of course, when the USB device and host are transmitting normally, us->iobuf size is 64, which is enough for CBW/CSW and there will be no problem. 
> Howerver, we encountered a problem in the FPGA verification environment, that is, the DWC otg controller detected a Babble Error, and we believe that the processing flow of the device driver will cause the risk of us->iobuf overflow. 
> 
> 
> Regarding USB Babble Error, the DWC_otg_programming manual describes it as follows:
> |
> 
> 3.8.1 Handling Babble Conditions
> 
> DWC_otg handles two cases of babble: packet babble and port babble. Packet babble occurs if the device sends more data than the maximum packet size for the channel. Port babble occurs if the controller continues to receive data from the device at EOF2 (the end of frame 2, which is very close to SOF).
> 
> When DWC_otg detects a packet babble, it stops writing data into the Rx buffer and waits for the end of packet (EOP). When it detects an EOP, it flushes already-written data in the Rx buffer and generates a Babble interrupt to the application
> 
> |

What is your point?

Are you claiming that the DWC_otg driver doesn't handle packet babble 
properly?  If that is true then you need to fix the DWC_otg driver, not 
change the usb-storage driver.

You have not done a good job of explaining how us->iobuf overflow could 
occur.

Alan Stern