From: Maoyi Xie <maoyixie.tju@gmail•com>
To: Andrew Jeffery <andrew@codeconstruct•com.au>,
Neal Liu <neal_liu@aspeedtech•com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation•org>,
Benjamin Herrenschmidt <benh@kernel•crashing.org>,
Joel Stanley <joel@jms•id.au>, Andrew Jeffery <andrew@aj•id.au>,
Alan Stern <stern@rowland•harvard.edu>,
linux-aspeed@lists•ozlabs.org,
linux-arm-kernel@lists•infradead.org, linux-usb@vger•kernel.org,
linux-kernel@vger•kernel.org
Subject: [PATCH v2] usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
Date: Tue, 19 May 2026 16:02:13 +0800 [thread overview]
Message-ID: <20260519080213.1932516-1-maoyixie.tju@gmail.com> (raw)
In-Reply-To: <20260518073403.1285339-1-maoyi.xie@ntu.edu.sg>
ast_udc_ep_dequeue() declares the loop cursor `req` outside the
list_for_each_entry(). After the loop it tests `&req->req != _req`
to decide whether the request was found. If the queue holds no
match, `req` is past-the-end. It then aliases
container_of(&ep->queue, struct ast_udc_request, queue) via offset
cancellation. Whether that synthetic address equals `_req` depends
on heap layout. The function can return 0 without dequeueing
anything.
Walk the list with a separate `iter`. Set `req` only when a
request matches. After the loop, `req` is NULL if nothing
matched.
Suggested-by: Alan Stern <stern@rowland•harvard.edu>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail•com>
---
v2: Switch the loop body to Alan Stern's shape: test inside
the if, assign `req`, break. Same behaviour as v1.
v1: https://lore.kernel.org/linux-usb/20260518073403.1285339-1-maoyi.xie@ntu.edu.sg/
drivers/usb/gadget/udc/aspeed_udc.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
--- a/drivers/usb/gadget/udc/aspeed_udc.c 2026-05-19 15:29:28.690931576 +0800
+++ b/drivers/usb/gadget/udc/aspeed_udc.c 2026-05-19 15:29:59.482953528 +0800
@@ -692,26 +692,30 @@
{
struct ast_udc_ep *ep = to_ast_ep(_ep);
struct ast_udc_dev *udc = ep->udc;
- struct ast_udc_request *req;
+ struct ast_udc_request *req = NULL, *iter;
unsigned long flags;
int rc = 0;
spin_lock_irqsave(&udc->lock, flags);
/* make sure it's actually queued on this endpoint */
- list_for_each_entry(req, &ep->queue, queue) {
- if (&req->req == _req) {
- list_del_init(&req->queue);
- ast_udc_done(ep, req, -ESHUTDOWN);
- _req->status = -ECONNRESET;
+ list_for_each_entry(iter, &ep->queue, queue) {
+ if (&iter->req == _req) {
+ req = iter;
break;
}
}
- /* dequeue request not found */
- if (&req->req != _req)
+ if (!req) {
rc = -EINVAL;
+ goto out;
+ }
+
+ list_del_init(&req->queue);
+ ast_udc_done(ep, req, -ESHUTDOWN);
+ _req->status = -ECONNRESET;
+out:
spin_unlock_irqrestore(&udc->lock, flags);
return rc;
--
2.34.1
next prev parent reply other threads:[~2026-05-19 8:02 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-18 7:34 [PATCH] usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue Maoyi Xie
2026-05-18 21:43 ` Alan Stern
2026-05-19 8:02 ` Maoyi Xie [this message]
2026-05-20 2:01 ` [PATCH v2] " Andrew Jeffery
2026-05-21 6:54 ` [PATCH v3] " Maoyi Xie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260519080213.1932516-1-maoyixie.tju@gmail.com \
--to=maoyixie.tju@gmail$(echo .)com \
--cc=andrew@aj$(echo .)id.au \
--cc=andrew@codeconstruct$(echo .)com.au \
--cc=benh@kernel$(echo .)crashing.org \
--cc=gregkh@linuxfoundation$(echo .)org \
--cc=joel@jms$(echo .)id.au \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-aspeed@lists$(echo .)ozlabs.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-usb@vger$(echo .)kernel.org \
--cc=neal_liu@aspeedtech$(echo .)com \
--cc=stern@rowland$(echo .)harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox