From nobody Sat Jul 25 19:26:41 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1F8002D0C8F for ; Tue, 14 Jul 2026 09:34:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784021672; cv=none; b=Er6GHPRJM08qdn4kcI1Dt15JSp6q19z4lN1PndrgZ+xvPKPxKkae8P1HCLBxpRtAme1/YSA75F4cMqubnOtpbcyKPmBwDplB2kwRp2wVijYxhXfxeQyh0E1Z7z62XNYplQnbq2Mi9QEaQVhlqsfhj0GUrnkL1djDPjB5UFJaDGc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784021672; c=relaxed/simple; bh=RTg/1qKo3UGXOLuXy/F+7itQETel3IEcHYP6zA0MqIQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uYLVCHxCDm4+13RSDCnGOk5e6kysEKr2seXb2xj4CdI83Qa9SDIk3iAU0NpW0uBRZ1pxld4hLbmehWr8fOgclYurjphN6UN5qNA06FKd0yunU2mC9V0OijSbekId45sQyF9+BzisRMLtIbqdIn3usJ4sOOgG1eKnaF9e/EPHF9Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bB9ncIK5; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bB9ncIK5" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-385ea3ce80dso4343924a91.2 for ; Tue, 14 Jul 2026 02:34:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784021669; x=1784626469; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Y0ciukRNvrXKS4VTFw+CW3KyarZ9Y0Wilda8EYfYO1A=; b=bB9ncIK52BGhS+vJVovtqvD4rOqzoDqwD3/OmjEq9SqNBNHvOdQIZ3ViV9B9ax1oBj YEXXG4UsJnaROr9E+8lWVp7YiGTybqD6HKidKTPKgtkqbaHoehSI5H2hSUeJIuX1/V/6 tQb6e6ufcwO5ma9UJdxqhBJNyRKv63BCXCfG7VcsFPbo+zC2fEpJYMT6joDxwO70L+9l ydVMXOLwWVjTrff0AZYMSJQYukx3EAGinbeJDSoz96t+KRV/IMs83rbB9qMfp6tv/m24 eQXB0BaWNPiACre8jNPs/4ef4Kl7jeU6isMYx1HY3wGByNNY8nkWwFvro99l1LzsNcyL lIEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784021669; x=1784626469; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Y0ciukRNvrXKS4VTFw+CW3KyarZ9Y0Wilda8EYfYO1A=; b=aukOdV37H4aoLWQoHIPguIi7YaRBGQLB6Y4uz63XWilywNMdA2Tiikgcamhm6Sg2Op YVvGJ5F0VzMZnc4acRXPwuSZmRwFQ9JRlBoOyXv7llQVpmoNGNVynOSmxrQR6R6i+fs2 F4tsjeyABnmCv4I/qsrLzfOM8rneirsIKgnU1XMnKbhOpb5lnbM3YKWagFqA1CBmoHe/ oaXF/oZ0KAvdcBxZichf4Lx2rgp8E7rIn+8NOY+wTnyVaP7Of5WUAKDUYMezWijicbw2 6fS0FBuKLHU2V9Fy2uJwaV8+aXenxOM4ntPa/59a/J/MetINBqYV6n0V0C1P5WmDEkzG O0PA== X-Forwarded-Encrypted: i=1; AHgh+Rqzgzbdf7yeT6cwl1ZCX2hjC+ekm0rOSPl/3ddllxCDEShJLccsUFlSSeEfShvil8I6MFni4d/0oygMTPI=@vger.kernel.org X-Gm-Message-State: AOJu0YzbelQ0aYx/mkXaAYfd3+YfYD3tIcif2odkrM0GpstHdFaCAh/L tn1bHd3H+/CD52VotQXnf3lRD+dFiUuhFlyExTqh9uv9bcPvTLcuWJ8VEdT8Nhycvjs= X-Gm-Gg: AfdE7cn9BMy+2agR3FNFay5X8Wyhxv1UH2WjylfeRgj9AU60g+nMp4uFMnnf0tNq5IO WoIxjYLRm2sknGVe2VEo7MHxCuRHWMbY/35DIKi+CJoez2dRfBfbxYE727rU3c0PUG5zix8gJfi D+qrGpH9QP5edGkHPTgvYf1mw7MJhnoNblpng1XmdCe4W9+1iY0dddzkTwCFw2nJOGq3Tq70mzI ttW16z6jZy8kiqMUXiu3cQaPY4rNa5j4i4Kb/M1HTig/3tRozZRPQyB+/suye3fHpW5HkEQOAf4 ABc8iw0BCZdNcDW3SfArvseB5H8ageXHsNdH5leKJOTGc0DLwHbvXVC1ONyKpRZZjV0aYSRF1L9 Bd/w1D//JWbQQO4hU+gOSmgDKOjkYXIJtuxKwzvU92tDOzN8GKZuvsLc4qsSayzK8t//ZOgZlff qx1b+GD68odrFn9aL+Ef2tsUQ+vc6P3/md7hmBykfFtg== X-Received: by 2002:a17:90b:3c83:b0:389:42e7:991c with SMTP id 98e67ed59e1d1-38e17dc80d5mr2245925a91.17.1784021669259; Tue, 14 Jul 2026 02:34:29 -0700 (PDT) Received: from shpark-MS-7E27.tailee9dcb.ts.net ([218.49.81.87]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9c20616sm113385495ad.34.2026.07.14.02.34.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 02:34:28 -0700 (PDT) From: Sunho Park To: Johan Hovold Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] USB: serial: io_edgeport: cap received transmit credits Date: Tue, 14 Jul 2026 18:34:24 +0900 Message-ID: <20260714093424.737303-1-shpark061104@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking maxTxCredits. edge_write() uses txCredits minus the software FIFO count as the amount of data that fits. Since the FIFO is allocated with maxTxCredits bytes, txCredits exceeding maxTxCredits can cause OOB write in ring buffer. Cap accumulated credits at maxTxCredits. Conforming devices should never hit the cap. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Sunho Park --- drivers/usb/serial/io_edgeport.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgep= ort.c index 34ccf7820537..503b3b5bb647 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -646,7 +646,10 @@ static void edge_interrupt_callback(struct urb *urb) if (edge_port && edge_port->open) { spin_lock_irqsave(&edge_port->ep_lock, flags); - edge_port->txCredits +=3D txCredits; + edge_port->txCredits =3D + min_t(unsigned int, + edge_port->txCredits + txCredits, + edge_port->maxTxCredits); spin_unlock_irqrestore(&edge_port->ep_lock, flags); dev_dbg(dev, "%s - txcredits for port%d =3D %d\n", base-commit: fad0fd120e29041b3e6cdf41bb12e3184fb524a2 --=20 2.43.0