tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc

We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.

Signed-off-by: Ma Ke <make_ruc2021@163.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Ma Ke and committed by
Greg Kroah-Hartman ce9daa2e e032368e

+2
+2
drivers/usb/gadget/udc/fsl_qe_udc.c
··· 1959 1959 } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { 1960 1960 /* Get endpoint status */ 1961 1961 int pipe = index & USB_ENDPOINT_NUMBER_MASK; 1962 + if (pipe >= USB_MAX_ENDPOINTS) 1963 + goto stall; 1962 1964 struct qe_ep *target_ep = &udc->eps[pipe]; 1963 1965 u16 usep; 1964 1966