mirrors/linux
0
0 Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-10-26 10:57:38 +08:00
Code Activity

usb: fotg210: validate endpoint index in ep0 handlers

Browse Source 
fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status()
use wIndex from the USB setup packet to index the fotg210->ep[] array
without verifying that the endpoint number falls below
FOTG210_MAX_NUM_EP (5).  USB_ENDPOINT_NUMBER_MASK is 0x0f, so a
malicious host can issue a setup packet with wIndex 5..15, resulting in
an out-of-bounds array read.  The resulting wild pointer is then
dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which
compute an MMIO register offset from ep->epnum and perform iowrite32
through it.

fotg210_clear_feature() is especially problematic: the out-of-bounds
access occurs at function entry (source-level) regardless of which
USB_RECIP_* case is taken, because the ep pointer is computed before the
switch statement.

Add upper-bound checks on the endpoint number derived from wIndex in
all three functions.  Invalid endpoint numbers in clear_feature now
trigger fotg210_request_error() (STALL) instead of silently falling
through to fotg210_set_cxdone().  Also add the missing le16_to_cpu()
conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse
endianness warning.

Fixes: b84a8dee23 ("usb: gadget: add Faraday fotg210_udc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260913120458.1608186-1-liuc63@xiaopeng.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Liu Chao authored and Greg Kroah-Hartman committed 2026-09-16 19:11:32 +01:00
1 parent 5753127339
commit bbddb219b0
1 file changed
+11 -6
Download Patch File Download Diff File Expand all files Collapse all files
drivers/usb/fotg210/fotg210-udc.c
+11 -6
View File
@@ -666,7 +666,7 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
case USB_RECIP_ENDPOINT: {
u8 epnum;
epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
if (epnum)
if (epnum && epnum < FOTG210_MAX_NUM_EP)
fotg210_set_epnstall(fotg210->ep[epnum]);
else
fotg210_set_cxstall(fotg210);
@@ -682,8 +682,8 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210,
static void fotg210_clear_feature(struct fotg210_udc *fotg210,
struct usb_ctrlrequest *ctrl)
{
struct fotg210_ep *ep =
fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK];
u8 epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
struct fotg210_ep *ep;
switch (ctrl->bRequestType & USB_RECIP_MASK) {
case USB_RECIP_DEVICE:
@@ -693,7 +693,12 @@ static void fotg210_clear_feature(struct fotg210_udc *fotg210,
fotg210_set_cxdone(fotg210);
break;
case USB_RECIP_ENDPOINT:
if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) {
if (epnum >= FOTG210_MAX_NUM_EP) {
fotg210_request_error(fotg210);
break;
}
if (epnum) {
ep = fotg210->ep[epnum];
if (ep->wedged) {
fotg210_set_cxdone(fotg210);
break;
@@ -749,8 +754,8 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
fotg210->ep0_data = cpu_to_le16(0);
break;
case USB_RECIP_ENDPOINT:
epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK;
if (epnum)
epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK;
if (epnum && epnum < FOTG210_MAX_NUM_EP)
fotg210->ep0_data =
cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum])
<< USB_ENDPOINT_HALT);