From nobody Sat Jul 25 19:26:40 2026 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20BCC368D5A for ; Tue, 14 Jul 2026 10:42:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784025757; cv=none; b=J87ASOV5dhNuZ58q7AyGjOVUynnWIfGMFGxEm7IZyR4o8xqe1OC0h09X26WtoWnTIgIra6TCXOxo/Uf9Oonvmpe56TVf3y/qxjW90lsDhabMTrNBWRHdZzKrlB8xE00OhEmNuIvj7yMBA+/Iradt4eCTpOt8OXSrmnkULvgWaWU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784025757; c=relaxed/simple; bh=v2UFRc3hCq6ndzphXPPUaXi0vTBlhfM6fUCfFget3+Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KlPT5MgsK/OxWU8er56sMC2GO7K9SLnYVJdieUPU4j4ZFhZIlL+/BFHvK4LjuQUfQ4OUHXlbFqPBIo1mH0jJBw1Fd7kaNghlLUw/WdTvSX+s5L4PgCMta16J85i/pPMLFhU1cSJDMlZzAFtGip3+s64TC5/x2M/3KDkEI8DCXEk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JaVJhjPo; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JaVJhjPo" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-848761b5897so2007720b3a.3 for ; Tue, 14 Jul 2026 03:42:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784025755; x=1784630555; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Rb/9zQ+PZjUoKpNH5YAXgELyTFN4ZKX8rq7xqLFNy+w=; b=JaVJhjPo2gL1ve1DxfM7LW59OIVmkI8GqW/aBSvsfwkQb7X2tHc1WmIUWNwltMJtaM Fyn6s0AknT9RTq7bFvkf+zAZP2RE0dZ142djcgziqVuuAz5rksqovViHb3p/ZxmvhvCH diVoP2aMm4yyI+3t3eBaG2SfsQC5xgzfOSTsCAPGJRToE8eWO0W414SUYrU4fsRFq7zH 91LdL66DmwjXwrh17IEOUUluI/U6/bfGcCzZdYPPhL4mpgAgpB2wx3EOCgO/u4tGRrEv l0R1pR9rfoFEkWrRQPao52/si+KbV4Z5I/cUrwz3vob1gjGMXyQqO2qmvcCUvvhPm1v+ Pskg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784025755; x=1784630555; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Rb/9zQ+PZjUoKpNH5YAXgELyTFN4ZKX8rq7xqLFNy+w=; b=ZQJC9Z5jx0EBCiSodA6xI1PKksTRewZPMD31AEb8Z2ruPZz48iK5XvPM5dq/Kh1b+v HFWN3XzZJV0l9xnNfTBaAmlhyfeIlrSmeXhgeERg40dkTEoe5wylEXN1A4vf6s1CQ5ri Ck1c+5PoL4LQoY1pWwUQVgYS1vZnn5Jtvl8o/S/U+S+f8hV3mg2QtrHcKhgs4++8fz5P gIPj9PcpQg0ey6EPouUGE+s2cbA2mvYFIbgcIqWR8lwOdKqgxX/Anc/ac2O8HYbBLXGb STNmURbq21eBkabVfIS/rsp963dV7cImJgMM2ar6QhztQ2smFZJ2uSZvmDHEC2rjwlH5 ZbqA== X-Forwarded-Encrypted: i=1; AHgh+RrdROiXzBFD4EtdfelvM7sMnkSqFF+2wpVq11DIE4MT9L4wgdSvHO9x/f+3Tx3l/9sEqRTShtpT3gnuV/Q=@vger.kernel.org X-Gm-Message-State: AOJu0YwiihBYL77avHTZLNw3BmN8UvjQ4Zs4fC6zdh6OX+eCgPMYZYN2 52M46jGhrj35JvOEdeKhrpxfxpeBZCHSciVaY8vX5WNlfNOnO9Cz4jlT X-Gm-Gg: AfdE7cmXm4OXJPlfeYZkzaErXqlaHEFmKk4JIUYNwXrccHFpHyR5JRTAg3FQipjnopv VPqxA1v9Wj+N4js4mklR7gn7E3WYbAVX/Vr/mAuMtODXN3vfK2QOpa0kEHHYKLRBb6CzPtyk7j+ vjZ0XIG00nTapyXd+lyRWdIRiz75kMorZAqecbzvR30NOVNlK2mf77vNT2xyZVdDe54eTooUloL cfg0c98HPfkHSefLhvAmoVzPVQe70OqvgS/DhGfYfUn1ke8CObAfhBPPLTcAA4g9a727cql00qS nXMTeGff5DAy3v8gMB5mj4FR/Qqz5L+tdASEpTNyiJMxtOuobF7vGpKSmvrnXkvYWPJDUdfR/va JQC0QCJ2NjQvl/DXn+p2KqUiuDddZSNOWl4aW8rv/lpY3mi2wyM02Z5vHXvNw11L0u4lmd18mWx knqdfZg9HU+jSwR+LMbUUHg10GNeWFm20Z/xKkFP040Q== X-Received: by 2002:a05:6a00:3305:b0:848:2f6e:e52b with SMTP id d2e1a72fcca58-84a55851418mr2036499b3a.63.1784025755439; Tue, 14 Jul 2026 03:42:35 -0700 (PDT) Received: from shpark-MS-7E27.tailee9dcb.ts.net ([218.49.81.87]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ca5af7d58e8sm9667849a12.2.2026.07.14.03.42.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 03:42:35 -0700 (PDT) From: Sunho Park To: Johan Hovold Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3] USB: serial: io_edgeport: cap received transmit credits Date: Tue, 14 Jul 2026 19:42:30 +0900 Message-ID: <20260714104230.893968-1-shpark061104@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking maxTxCredits. edge_write() uses txCredits minus the software FIFO count as the amount of data that fits. Since the FIFO is allocated with maxTxCredits bytes, txCredits exceeding maxTxCredits can cause OOB write in ring buffer. Cap accumulated credits at maxTxCredits. Conforming devices should never hit the cap. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Sunho Park --- V2 -> V3: Added missing revision history (no code changes) V1 -> V2: Replaced min_t() with min()=20 v2: https://lore.kernel.org/linux-usb/20260714101316.823942-1-shpark061104@= gmail.com/ v1: https://lore.kernel.org/linux-usb/20260714093424.737303-1-shpark061104@= gmail.com/ --- drivers/usb/serial/io_edgeport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgep= ort.c index 34ccf7820537..2ab3f8262259 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -646,7 +646,9 @@ static void edge_interrupt_callback(struct urb *urb) if (edge_port && edge_port->open) { spin_lock_irqsave(&edge_port->ep_lock, flags); - edge_port->txCredits +=3D txCredits; + edge_port->txCredits =3D + min(edge_port->txCredits + txCredits, + edge_port->maxTxCredits); spin_unlock_irqrestore(&edge_port->ep_lock, flags); dev_dbg(dev, "%s - txcredits for port%d =3D %d\n", base-commit: fad0fd120e29041b3e6cdf41bb12e3184fb524a2 --=20 2.43.0