Skip to content

Commit e49cad8

Browse files
committed
dcd_pic32: Fix memory overwrite in incoming data
When transfer was finished rx_fifo_read() read all that was to read RXPKTRDY was cleared allowing next packet to be received. Then xfer_complete was called. Interrupt for OUT endpoint was left enable, that would not be a problem if data was handled fast and new transfer was scheduled. For MSC when host sends a lot of data this interrupt that was enabled could cause epn_handle_rx_int() to be called after transfer was completed and next was not scheduled yet. Without TU_ASSERT that was added to detect this, incoming data was written past buffer provided by user code resulting in random memory corruption. This just blocks RX interrupt when transfer is finished, and also only unmasked rx interrupts are handled.
1 parent c145777 commit e49cad8

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/portable/microchip/pic32mz/dcd_pic32mz.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -564,6 +564,7 @@ static void epn_handle_rx_int(uint8_t epnum)
564564
TU_ASSERT(xfer->transferred <= xfer->total_len,);
565565
if (transferred < xfer->max_packet_size || xfer->transferred == xfer->total_len)
566566
{
567+
USB_REGS->INTRRXEbits.w &= ~(1u << epnum);
567568
xfer_complete(xfer, XFER_RESULT_SUCCESS, true);
568569
}
569570
}
@@ -692,7 +693,7 @@ void dcd_int_handler(uint8_t rhport)
692693
int i;
693694
uint8_t mask;
694695
__USBCSR2bits_t csr2_bits;
695-
uint16_t rxints = USB_REGS->INTRRX;
696+
uint16_t rxints = USB_REGS->INTRRX & USB_REGS->INTRRXEbits.w;
696697
uint16_t txints = USB_REGS->INTRTX;
697698
csr2_bits = USBCSR2bits;
698699
(void) rhport;

0 commit comments

Comments
 (0)