downstream: rebase devel onto v11.1.0 - #39
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3af133e49e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for (unsigned int i = 0; i < size; i++) { | ||
| if (byen & (1u << ((addr + i) & 3))) { | ||
| space[i] = data[i]; |
There was a problem hiding this comment.
When a guest sends an RTL8152 vendor SET_REGS request whose translated register offset is near 0xffff, this loop writes all guest-controlled wLength bytes without checking the remaining bank size. For example, after selecting OCP base 0xf000, an access at 0xbfff translates to the last byte of rtl_ocp, so a length of 2 already writes beyond the device object; USB permits lengths up to the 4096-byte control buffer. The analogous unchecked memcpy() in rtl8152_reg_read() can disclose out-of-bounds host memory, so both paths should reject transfers whose translated offset plus length exceeds the selected 64-KiB bank.
Useful? React with 👍 / 👎.
3af133e to
ea9a059
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea9a059155
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| usb_packet_copy(p, &s->in_buf[s->in_ptr], len); | ||
| s->in_ptr += len; | ||
| if (s->in_ptr >= s->in_len && ((s->in_len & (64 - 1)) || !len)) { |
There was a problem hiding this comment.
When the device negotiates high speed, bulk endpoint 1 has a 512-byte maximum packet size, but this condition still treats every multiple of 64 as requiring a terminating zero-length packet. For example, a 100-byte Ethernet frame produces a 128-byte RX record; that is already a short high-speed packet, yet the buffer remains occupied and the next host URB receives a spurious ZLP before queued traffic is flushed. Base this decision on the active endpoint's maximum packet size rather than the full-speed constant.
Useful? React with 👍 / 👎.
1 participant
This PR is for CI validation only. If all CI checks pass, the rebased branch will be force-pushed to
devel.Summary
develseries onto thev11.1.0tag.subsystem: summarystyle.Validation
git diff --checkSigned-off-bytrailer.