Commit 5253aded authored by Stefan Brüns's avatar Stefan Brüns Committed by Marek Vasut
Browse files

usb: dwc2: avoid out of bounds access

flush_dcache_range may access data after priv->aligned_buffer end if
memcpy may access data after buffer end if done > 0
Signed-off-by: default avatarStefan Brüns <>
Acked-by: default avatarMarek Vasut <>
Acked-by: default avatarStephen Warren <>
parent c75f57fb
......@@ -823,12 +823,13 @@ int chunk_msg(struct dwc2_priv *priv, struct usb_device *dev,
if (!in) {
memcpy(priv->aligned_buffer, (char *)buffer + done, len);
if (!in && xfer_len) {
memcpy(priv->aligned_buffer, (char *)buffer + done,
flush_dcache_range((unsigned long)priv->aligned_buffer,
(unsigned long)((void *)priv->aligned_buffer +
roundup(len, ARCH_DMA_MINALIGN)));
roundup(xfer_len, ARCH_DMA_MINALIGN)));
writel(phys_to_bus((unsigned long)priv->aligned_buffer),
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment