From patchwork Tue Aug 23 18:27:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Khalid Masum X-Patchwork-Id: 600219 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32457C32772 for ; Tue, 23 Aug 2022 19:34:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231896AbiHWTe4 (ORCPT ); Tue, 23 Aug 2022 15:34:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230457AbiHWTe3 (ORCPT ); Tue, 23 Aug 2022 15:34:29 -0400 Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 373061C2; Tue, 23 Aug 2022 11:28:14 -0700 (PDT) Received: by mail-pg1-x532.google.com with SMTP id 202so12979638pgc.8; Tue, 23 Aug 2022 11:28:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc; bh=wmSMCRFZSxcgnDSmELzb7JIe5u2Gi0VRVmvHwrpfAws=; b=lpp9S+kBi2bxX0uqMqqitmwkC/F8KjETINbFgtPX33rOBLZqiofK8OVkTuZF6cTqi5 cIISJO5g0NVILJpqVy2mX/Jthv8Ri7x0qpO0lbdONdYHf0mJ5kVX+U6pMpPN8p9IdyWz eW+owDT42DCziICeAHUyStY66gE+FRKa1aaIm+LOfQazFWF6GrxxBG72t0/50OAVkPxC Ga+aZAl61sD92lYYOMcCpcHYhx/Tj79KRsVDoTINYuh+4/79S6zf+XulGFmyM+SeTTkI M4i7x7BLdJPddgYzmP3PZKksDl5jJZ0Ojbsar2GA6C5RVWNkerJxwp2dRRLfccXfMeHC rTcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=wmSMCRFZSxcgnDSmELzb7JIe5u2Gi0VRVmvHwrpfAws=; b=1ORrnK47EbyJPsBik9lNqn16HXhZO0qbl69qqi/j7Bnj9PNCOOzAGNJoYq6GE/2uzc 6E6svWXIMHrTTnKPL47X3nLjczPoNCyM6rsV2ZLxpASF014ZaFtHSaWfmsOa5xH1vgKl Eka6RFLpK81ItfUSx4nCC3clMqEwRFOf1x/jUkqP7HGnm145TQk/IXKOzlH5Ax5V6k/Z E0+SW2H2BGnikg3aaZ3EQgF9BHR9FoJtzX/LWFv6gQ/XeNGGrwb8TpSrCnkqbsc7omSt sc1gCp/Yhe7cpDhiT9D7pjfsBNYwBreCVq1ndx+trQ3F9T/DnGOPtFF0EAHWQKRS3qQW EXtQ== X-Gm-Message-State: ACgBeo20JPOa7wgbxbr8RqgdjrqLZgCu0XeAzHlxpAkDSYRtUM1fvGnP kjUCleUZRTwiwsGueaD9jurnmlMQyGQNaA== X-Google-Smtp-Source: AA6agR7TIJQ4Mm+joOcCymHFuewcD/S1AtW0VepCnt5olMRV4A3d0Q/2sbKF/Bz/l2i4KZqJ31zepw== X-Received: by 2002:a63:310e:0:b0:429:bf9c:99ed with SMTP id x14-20020a63310e000000b00429bf9c99edmr21123513pgx.524.1661279293034; Tue, 23 Aug 2022 11:28:13 -0700 (PDT) Received: from fedora.. ([103.159.189.136]) by smtp.gmail.com with ESMTPSA id b13-20020a17090a6e0d00b001f2fa09786asm10328798pjk.19.2022.08.23.11.28.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Aug 2022 11:28:12 -0700 (PDT) From: Khalid Masum To: Alan Stern , Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Khalid Masum Subject: [PATCH 1/2] usb: ehci: Prevent possible modulo by zero Date: Wed, 24 Aug 2022 00:27:57 +0600 Message-Id: <20220823182758.13401-2-khalid.masum.92@gmail.com> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220823182758.13401-1-khalid.masum.92@gmail.com> References: <20220823182758.13401-1-khalid.masum.92@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org usb_maxpacket() returns 0 if it fails to fetch the endpoint. This value is later used for calculating modulo. Which can cause modulo by zero in qtd_fill and qh_urb_transaction. Prevent this breakage by returning if maxpacket is found to be 0. Fixes coverity warning: 744857 ("Division or modulo by zero") Signed-off-by: Khalid Masum --- drivers/usb/host/ehci-q.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c index 807e64991e3e..eb31d13e9ecd 100644 --- a/drivers/usb/host/ehci-q.c +++ b/drivers/usb/host/ehci-q.c @@ -646,6 +646,8 @@ qh_urb_transaction ( /* else it's already initted to "out" pid (0 << 8) */ maxpacket = usb_maxpacket(urb->dev, urb->pipe); + if (unlikely(!maxpacket)) + return NULL; /* * buffer gets wrapped in one or more qtds; From patchwork Tue Aug 23 18:27:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Khalid Masum X-Patchwork-Id: 599689 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36F91C32789 for ; Tue, 23 Aug 2022 19:34:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232137AbiHWTe5 (ORCPT ); Tue, 23 Aug 2022 15:34:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232371AbiHWTeb (ORCPT ); Tue, 23 Aug 2022 15:34:31 -0400 Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 73AE8D4E; Tue, 23 Aug 2022 11:28:17 -0700 (PDT) Received: by mail-pl1-x62e.google.com with SMTP id g8so9657781plq.11; Tue, 23 Aug 2022 11:28:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc; bh=OpAAIbRmUtdooRSc8Rz9ZxA5vB7ijPi1Sxv/YxOpbd0=; b=TQZ7Njj2HSqfRtNonDUamFWpQzengfi3aP/z9bMDz2hgz6sm33sjqV0Moga+WWDBk+ XFPKoC//wiiYR2o6XMkiF2qLflgsyBnIiMf1R/t89RCCZ1ovAAF+njoXR+ypU6pK7pO2 zXaMP0O3d1HKaKjQkT9xOdTQb7VG+blhBlGW8Ghy59ncG0gVgKmd3UvI97E/5itdCCOw V0SYtynPduFvzwRapuKXwdNX6OpCM4qOZDSA/y7cBYe10BliKEojfntsryU6uCvKox5V dOgjJ/KLnTCM/EL7QBMn+fScGvIlg+AIBWaQXaYXiWXgwhYJK1iAivVZVpOJjd+QLwT2 eSng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc; bh=OpAAIbRmUtdooRSc8Rz9ZxA5vB7ijPi1Sxv/YxOpbd0=; b=3FYFNcITePVlD9ZDvlWhqZ8+rk1nSsy0yfqLoPggV4WXrBoqkiFg5+Gh4jSTunD14i 6UgOStvGKc0jj5p41tPccN4RRahl7s/bYPvSJY0W7Tqk4MD0fUZBdlGBK2WNSOp30VXb c6USMDJ05zzP1MqhJhPAzlECK7m8LNPwtzD1VymxqblfljTKjJZkp8Ovn5+W35OEnaPZ 3hwOFi942etdkZDmbn0WfpjJjw9Y3nAAJf8SQjlDdMhk98BJXM6BPfLq2f0ZVp2CA6sI zJdg+aDboNNDOZNCqEmga+e3pCwsqMLY/cKyzG3Dqt2T1pOOrVZzx/bvSfQWTKtfqPVi JkVw== X-Gm-Message-State: ACgBeo1KEXMRB/57sUcU89hftkGJw8rf1cXlii13fmUcGwv8yyQhGBWV LB+PC7o56Pxb8Di0HBicsoc= X-Google-Smtp-Source: AA6agR6QUGf4KzNGBA4P7wW4ovQFBCcvNBnlzOkfXTukL8GORqxCa2a2d0ra2N5k2Cn7+H1eRZDzPQ== X-Received: by 2002:a17:902:e5d1:b0:16f:15a1:6dbc with SMTP id u17-20020a170902e5d100b0016f15a16dbcmr25391045plf.73.1661279296326; Tue, 23 Aug 2022 11:28:16 -0700 (PDT) Received: from fedora.. ([103.159.189.136]) by smtp.gmail.com with ESMTPSA id b13-20020a17090a6e0d00b001f2fa09786asm10328798pjk.19.2022.08.23.11.28.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Aug 2022 11:28:15 -0700 (PDT) From: Khalid Masum To: Alan Stern , Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Khalid Masum Subject: [PATCH 2/2] usb: ehci: Prevent possible modulo by zero Date: Wed, 24 Aug 2022 00:27:58 +0600 Message-Id: <20220823182758.13401-3-khalid.masum.92@gmail.com> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220823182758.13401-1-khalid.masum.92@gmail.com> References: <20220823182758.13401-1-khalid.masum.92@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org usb_maxpacket() returns 0 if it fails to fetch the endpoint. This value is later used for calculating modulo. Which can cause modulo by zero in qtd_fill. Prevent this breakage by returning if maxpacket is found to be 0. Fixes coverity warning: 1487371 ("Division or modulo by zero") Fixes: 9841f37a1cca ("usb: ehci: Add support for SINGLE_STEP_SET_FEATURE test of EHSET") Signed-off-by: Khalid Masum --- drivers/usb/host/ehci-q.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c index eb31d13e9ecd..cf2585e9a09f 100644 --- a/drivers/usb/host/ehci-q.c +++ b/drivers/usb/host/ehci-q.c @@ -1221,6 +1221,8 @@ static int ehci_submit_single_step_set_feature( token |= (1 /* "in" */ << 8); /*This is IN stage*/ maxpacket = usb_maxpacket(urb->dev, urb->pipe); + if (unlikely(!maxpacket)) + return -1; qtd_fill(ehci, qtd, buf, len, token, maxpacket);