Commit 75bbc2b9748b51d230faafab73ba86fd76e326f1
Committed by
Greg Kroah-Hartman
1 parent
f5dc00496f
xhci: fix garbage USBSTS being logged in some cases
commit 3105bc977d7cbf2edc35e24cc7e009686f6e4a56 upstream. xhci_decode_usbsts() is expected to return a zero-terminated string by its only caller, xhci_stop_endpoint_command_watchdog(), which directly logs the return value: xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(str, usbsts)); However, if no recognized bits are set in usbsts, the function will return without having called any sprintf() and therefore return an untouched non-zero-terminated caller-provided buffer, causing garbage to be output to log. Fix that by always including the raw value in the output. Note that before commit 4843b4b5ec64 ("xhci: fix even more unsafe memory usage in xhci tracing") the result effect in the failure case was different as a static buffer was used here, but the code still worked incorrectly. Fixes: 9c1aa36efdae ("xhci: Show host status when watchdog triggers and host is assumed dead.") Cc: stable@vger.kernel.org Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20220303110903.1662404-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 1 changed file with 4 additions and 1 deletions Side-by-side Diff
drivers/usb/host/xhci.h
... | ... | @@ -2624,8 +2624,11 @@ |
2624 | 2624 | { |
2625 | 2625 | int ret = 0; |
2626 | 2626 | |
2627 | + ret = sprintf(str, " 0x%08x", usbsts); | |
2628 | + | |
2627 | 2629 | if (usbsts == ~(u32)0) |
2628 | - return " 0xffffffff"; | |
2630 | + return str; | |
2631 | + | |
2629 | 2632 | if (usbsts & STS_HALT) |
2630 | 2633 | ret += sprintf(str + ret, " HCHalted"); |
2631 | 2634 | if (usbsts & STS_FATAL) |