[PATCH] usb: gadget: udc-xilinx: clamp bytes_to_rx in xudc_ep0_out()

[Liu Chao <liuc63@xiaopeng.com>]

xudc_ep0_out() reads the received byte count from a hardware register
and adds it to req->usb_req.actual without checking whether it exceeds
the remaining buffer space (req->usb_req.length - req->usb_req.actual).
The same unclamped count is then passed to memcpy_toio(), which can
write past the end of the request buffer.

A malicious USB host can send more data than the gadget function
expects on a control OUT transfer, triggering a heap buffer overflow.

Note that Haofeng Li's recent patch for the non-EP0 path
(xudc_read_fifo) explicitly excludes EP0, so this code path was not
covered by that fix.

Clamp bytes_to_rx to the remaining buffer space before accumulating it.

Fixes: 1f7b0c6d8e34 ("usb: gadget: udc-xilinx: Add Software data structures and APIs for xilinx udc")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/udc-xilinx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
index bef06fe75..77f06076e 100644
--- a/drivers/usb/gadget/udc/udc-xilinx.c
+++ b/drivers/usb/gadget/udc/udc-xilinx.c
@@ -1842,6 +1842,8 @@ static void xudc_ep0_out(struct xusb_udc *udc)
 		ep0rambase = (u8 __force *) (udc->addr +
 			     (ep0->rambase << 2));
 		buffer = req->usb_req.buf + req->usb_req.actual;
+		if (bytes_to_rx > req->usb_req.length - req->usb_req.actual)
+			bytes_to_rx = req->usb_req.length - req->usb_req.actual;
 		req->usb_req.actual = req->usb_req.actual + bytes_to_rx;
 		memcpy_toio((void __iomem *)buffer, ep0rambase, bytes_to_rx);
 
-- 
2.50.1