From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3CC28C4332F for ; Thu, 17 Nov 2022 09:50:41 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id AE2C585219; Thu, 17 Nov 2022 10:50:38 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="aqdRwKI9"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 7215A85220; Thu, 17 Nov 2022 10:50:37 +0100 (CET) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 47C3C85089 for ; Thu, 17 Nov 2022 10:50:35 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=szymon.heidrich@gmail.com Received: by mail-lf1-x12a.google.com with SMTP id r12so1972522lfp.1 for ; Thu, 17 Nov 2022 01:50:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Wujh2CAYpSC/0PpvkhPT8Jjt/kAAMB3oCzEWyWpC7uA=; b=aqdRwKI9MJXos0smP0psVH22LwAhq/sDOESQLhGmkL3NNCauw61oe2L/xsgYqFGGKe rQ9g645rRozlU10Fegi9KDdf5NC2EA/SvaVZ445XguzTBNNKxsPnSZ0hdmd2e7PC8W9L Y+sB33eFVMuwHaN4ErAkouV+dhv8OTu4oOdz2xw/FJlR3/JJEdZFV6eX2QYkHaTWPrqJ MpoF0uPPNvah4ASUPZ47Cy4IPxk3NhG5+rwkUYCGI9wnI092Wm/amEZAcw+Ma1gjJWvs mFsqzARUllPsRXyIDENtoF183t4qf5fn+n7pMJgtBhyhJwIDZo7Ftp2MT3R0psX3GDtR ZSxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Wujh2CAYpSC/0PpvkhPT8Jjt/kAAMB3oCzEWyWpC7uA=; b=I/Mk0Dha+NlYPSzANaHQosb/TAtT+Q9gML53FNIoO69Mva9JzLUM5OJ6jJHClo9bUr 1z5ZneZ7rItecH6XXoAZH79dbvwILdT/pX+D6zdSaJrtgk4rS8BHMlzzp01tU1Zti0VB pH1EjZaTe9Ruj3GDai1bWoUySmZrn2zOTbtOQ9PHtHxaz1CeNK3g1pzUhHr6obCaFpPW gwLezZTW6hlGdbGMis5S82B3+ZvtGdPspARZhQMEVjgB3XT4de6eELO85Uz6xv3I4b+M ZtYF6lpIiOL1Ynx3b7QayZ3DyeTmDUtv8GNqzq3pLrUJ9/kkILX/rI5U6u1dx9dwQgox AGSg== X-Gm-Message-State: ANoB5pmWs3s7zRfFjVirQGS5l0WOm+NodAlB7nZLj50C67cQJN0bFdYG Q9pdaGNJOSk4sTEV7mZPDC/UnTHxATOtYFn+ X-Google-Smtp-Source: AA0mqf6GDNn5EAT7bvs7enzddz/EEezt2P6nyx78Cy115C8ZIuhFQymVxVpPyYlB/5UcTwIEExJ1tQ== X-Received: by 2002:a19:9154:0:b0:4b4:6b9e:11d4 with SMTP id y20-20020a199154000000b004b46b9e11d4mr654535lfj.354.1668678634261; Thu, 17 Nov 2022 01:50:34 -0800 (PST) Received: from localhost.localdomain (077222237105.warszawa.vectranet.pl. [77.222.237.105]) by smtp.googlemail.com with ESMTPSA id h17-20020a19ca51000000b004b49c3a4861sm70441lfj.77.2022.11.17.01.50.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 01:50:33 -0800 (PST) From: Szymon Heidrich To: u-boot@lists.denx.de Cc: Szymon Heidrich Subject: [PATCH] Prevent buffer overflow on USB control endpoint Date: Thu, 17 Nov 2022 10:48:47 +0100 Message-Id: <20221117094847.60409-1-szymon.heidrich@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean Assure that the control endpoint buffer of size USB_BUFSIZ (4096) can not be overflown during handling of USB control transfer requests with wLength greater than USB_BUFSIZ. Signed-off-by: Szymon Heidrich --- drivers/usb/gadget/composite.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index 2a309e624e..cb89f6dca9 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1019,6 +1019,17 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) u8 endp; struct usb_configuration *c; + if (w_length > USB_BUFSIZ) { + if (ctrl->bRequestType & USB_DIR_IN) { + /* Cast away the const, we are going to overwrite on purpose. */ + __le16 *temp = (__le16 *)&ctrl->wLength; + *temp = cpu_to_le16(USB_BUFSIZ); + w_length = USB_BUFSIZ; + } else { + goto done; + } + } + /* * partial re-init of the response message; the function or the * gadget might need to intercept e.g. a control-OUT completion -- 2.38.1