tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: gadget: aspeed: fix buffer overflow

In ast_vhub_epn_handle_ack() when the received data length exceeds the
buffer, it does not check the case and just copies to req.buf and cause
a buffer overflow, kernel oops on this case.

This issue could be reproduced on a BMC with an OS that enables the
lan over USB:
1. In OS, enable the usb eth dev, verify it pings the BMC OK;
2. In OS, set the usb dev mtu to 2000. (Default is 1500);
3. In OS, ping the BMC with `-s 2000` argument.

The BMC kernel will get oops with below logs:

skbuff: skb_over_panic: text:8058e098 len:2048 put:2048 head:84c678a0 data:84c678c2 tail:0x84c680c2 end:0x84c67f00 dev:usb0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
Internal error: Oops - BUG: 0 [#1] ARM
CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.69-c9fb275-dirty-d1e579a #1
Hardware name: Generic DT based system
PC is at skb_panic+0x60/0x6c
LR is at irq_work_queue+0x6c/0x94

Fix the issue by checking the length and set `-EOVERFLOW`.

Tested: Verify the BMC kernel does not get oops in the above case, and
the usb ethernet gets RX packets errors instead.

Signed-off-by: Lei YU <yulei.sh@bytedance.com>
Signed-off-by: Henry Tian <tianxiaofeng@bytedance.com>
Reviewed-by: Neal Liu <neal_liu@aspeedtech.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Link: https://lore.kernel.org/r/20221024094853.2877441-1-yulei.sh@bytedance.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Henry Tian and committed by
Greg Kroah-Hartman 83045e19 9c3959bb

+13 -5
+1 -1
drivers/usb/gadget/udc/aspeed-vhub/core.c
··· 37 37 38 38 list_del_init(&req->queue); 39 39 40 - if (req->req.status == -EINPROGRESS) 40 + if ((req->req.status == -EINPROGRESS) || (status == -EOVERFLOW)) 41 41 req->req.status = status; 42 42 43 43 if (req->req.dma) {
+12 -4
drivers/usb/gadget/udc/aspeed-vhub/epn.c
··· 84 84 { 85 85 struct ast_vhub_req *req; 86 86 unsigned int len; 87 + int status = 0; 87 88 u32 stat; 88 89 89 90 /* Read EP status */ ··· 120 119 len = VHUB_EP_DMA_TX_SIZE(stat); 121 120 122 121 /* If not using DMA, copy data out if needed */ 123 - if (!req->req.dma && !ep->epn.is_in && len) 124 - memcpy(req->req.buf + req->req.actual, ep->buf, len); 125 - 122 + if (!req->req.dma && !ep->epn.is_in && len) { 123 + if (req->req.actual + len > req->req.length) { 124 + req->last_desc = 1; 125 + status = -EOVERFLOW; 126 + goto done; 127 + } else { 128 + memcpy(req->req.buf + req->req.actual, ep->buf, len); 129 + } 130 + } 126 131 /* Adjust size */ 127 132 req->req.actual += len; 128 133 ··· 136 129 if (len < ep->ep.maxpacket) 137 130 req->last_desc = 1; 138 131 132 + done: 139 133 /* That's it ? complete the request and pick a new one */ 140 134 if (req->last_desc >= 0) { 141 - ast_vhub_done(ep, req, 0); 135 + ast_vhub_done(ep, req, status); 142 136 req = list_first_entry_or_null(&ep->queue, struct ast_vhub_req, 143 137 queue); 144 138