[PATCH] usb: gadget: net2280: fix out-of-bounds read of short packet in write_fifo

[liuc63 <liuc63@xiaopeng.com>]

From: Liu Chao <liuc63@xiaopeng.com>

write_fifo() handles the trailing short word of an IN transfer by
reading a full 32-bit word from req->buf even when only 1..3 bytes
remain. get_unaligned((u32 *)buf) therefore reads up to three bytes
past the end of the request buffer, which KASAN reports as a
slab-out-of-bounds read.

The over-read bytes are not sent to the host: set_fifo_bytecount()
limits the FIFO to count & 0x03 bytes, so this is an out-of-bounds read
rather than an information leak.

Copy the remaining 1..3 bytes into a zero-padded word and feed that to
the existing get_unaligned()/cpu_to_le32s() sequence, so the trailing
word is built only from data that belongs to the request. The full-word
path above is unchanged, and reusing get_unaligned()/cpu_to_le32s()
keeps the byte order identical on both little- and big-endian hosts.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/net2280.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 7c5f30cfd24d..a1f5d11f82d2 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -649,7 +649,18 @@ static void write_fifo(struct net2280_ep *ep, struct usb_request *req)
 	 * when maxpacket is not a multiple of 4 bytes.
 	 */
 	if (count || total < ep->ep.maxpacket) {
-		tmp = count ? get_unaligned((u32 *)buf) : count;
+		/*
+		 * Don't read past the end of the request buffer: a short
+		 * trailing packet has only count & 0x03 valid bytes. Copy
+		 * them into a zero-padded word and reuse the same
+		 * get_unaligned()/cpu_to_le32s() sequence as the full-word
+		 * path above, so the byte order on the wire is unchanged.
+		 */
+		u8 tail[4] = {};
+
+		if (count)
+			memcpy(tail, buf, count & 0x03);
+		tmp = get_unaligned((u32 *)tail);
 		cpu_to_le32s(&tmp);
 		set_fifo_bytecount(ep, count & 0x03);
 		writel(tmp, &regs->ep_data);
-- 
2.50.1