From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ma Ke <make_ruc2021@163.com>, Li Yang <leoyang.li@nxp.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
linux-usb@vger.kernel.org, linuxppc-dev@lists.ozlabs.org
Subject: [PATCH AUTOSEL 6.4 13/25] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Date: Fri, 8 Sep 2023 20:37:01 -0400 [thread overview]
Message-ID: <20230909003715.3579761-13-sashal@kernel.org> (raw)
In-Reply-To: <20230909003715.3579761-1-sashal@kernel.org>
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit ce9daa2efc0872a9a68ea51dc8000df05893ef2e ]
We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 3b1cc8fa30c83..f4e5cbd193b7b 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
+ if (pipe >= USB_MAX_ENDPOINTS)
+ goto stall;
struct qe_ep *target_ep = &udc->eps[pipe];
u16 usep;
--
2.40.1
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-usb@vger.kernel.org, Ma Ke <make_ruc2021@163.com>,
Li Yang <leoyang.li@nxp.com>,
linuxppc-dev@lists.ozlabs.org
Subject: [PATCH AUTOSEL 6.4 13/25] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Date: Fri, 8 Sep 2023 20:37:01 -0400 [thread overview]
Message-ID: <20230909003715.3579761-13-sashal@kernel.org> (raw)
In-Reply-To: <20230909003715.3579761-1-sashal@kernel.org>
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit ce9daa2efc0872a9a68ea51dc8000df05893ef2e ]
We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 3b1cc8fa30c83..f4e5cbd193b7b 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
+ if (pipe >= USB_MAX_ENDPOINTS)
+ goto stall;
struct qe_ep *target_ep = &udc->eps[pipe];
u16 usep;
--
2.40.1
next prev parent reply other threads:[~2023-09-09 0:38 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-09 0:36 [PATCH AUTOSEL 6.4 01/25] media: mdp3: Fix resource leaks in of_find_device_by_node Sasha Levin
2023-09-09 0:36 ` Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 02/25] media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 03/25] media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer() Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 04/25] media: af9005: Fix null-ptr-deref in af9005_i2c_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 05/25] media: anysee: fix null-ptr-deref in anysee_master_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 06/25] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 07/25] media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 08/25] iio: core: Use min() instead of min_t() to make code more robust Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 09/25] scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is detected Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 10/25] media: tuners: qt1010: replace BUG_ON with a regular error Sasha Levin
2023-09-09 0:36 ` [PATCH AUTOSEL 6.4 11/25] media: pci: cx23885: replace BUG with error return Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 12/25] usb: cdns3: Put the cdns set active part outside the spin lock Sasha Levin
2023-09-09 0:37 ` Sasha Levin [this message]
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 13/25] usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 14/25] tools: iio: iio_generic_buffer: Fix some integer type and calculation Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 15/25] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 16/25] serial: cpm_uart: Avoid suspicious locking Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 17/25] misc: open-dice: make OPEN_DICE depend on HAS_IOMEM Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 18/25] workqueue: Call wq_update_unbound_numa() on all CPUs in NUMA node on CPU hotplug Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 19/25] usb: ehci: add workaround for chipidea PORTSC.PEC bug Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 20/25] usb: chipidea: add workaround for chipidea PEC bug Sasha Levin
2023-09-09 0:37 ` Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 21/25] media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 22/25] kobject: Add sanity check for kset->kobj.ktype in kset_register() Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 23/25] interconnect: Fix locking for runpm vs reclaim Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 24/25] usb: cdc-acm: move ldisc dcd notification outside of acm's read lock Sasha Levin
2023-09-11 9:19 ` Johan Hovold
2023-09-18 16:47 ` Sasha Levin
2023-09-09 0:37 ` [PATCH AUTOSEL 6.4 25/25] riscv: Add CFI error handling Sasha Levin
2023-09-09 0:37 ` Sasha Levin
2023-09-09 3:33 ` Palmer Dabbelt
2023-09-09 3:33 ` Palmer Dabbelt
2023-09-11 15:03 ` Sami Tolvanen
2023-09-11 15:03 ` Sami Tolvanen
2023-09-18 16:50 ` Sasha Levin
2023-09-18 16:50 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230909003715.3579761-13-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=leoyang.li@nxp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=make_ruc2021@163.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.