tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: gadget: bdc: validate status-report endpoint indices

bdc_sr_xsf() decodes a 5-bit endpoint number from the hardware status
report and uses it to index bdc->bdc_ep_array[] directly. The array is
only allocated to bdc->num_eps for the current controller instance, so a
status report can carry an endpoint number that still fits the 5-bit
field but does not fit the runtime-sized endpoint table.

Reject status reports whose endpoint number is outside bdc->num_eps
before indexing the endpoint array.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Justin Chen <justin.chen@broadcom.com>
Link: https://patch.msgid.link/20260323121730.75245-1-pengpeng@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Pengpeng Hou and committed by
Greg Kroah-Hartman a402532a d4cdecad

+4
+4
drivers/usb/gadget/udc/bdc/bdc_ep.c
··· 1647 1647 u8 ep_num; 1648 1648 1649 1649 ep_num = (le32_to_cpu(sreport->offset[3])>>4) & 0x1f; 1650 + if (ep_num >= bdc->num_eps) { 1651 + dev_err(bdc->dev, "xsf for invalid ep %u\n", ep_num); 1652 + return; 1653 + } 1650 1654 ep = bdc->bdc_ep_array[ep_num]; 1651 1655 if (!ep || !(ep->flags & BDC_EP_ENABLED)) { 1652 1656 dev_err(bdc->dev, "xsf for ep not enabled\n");