[PATCH] usb: gadget: composite: pass the validated interface index

[PATCH] usb: gadget: composite: pass the validated interface index

[Aldo Ariel Panzardo]

composite_setup() validates the low byte of wIndex as an interface
number, but passes the full 16-bit wIndex to the function's get_alt and
set_alt callbacks.  FunctionFS reverse-maps the low byte and then uses
the original callback argument to index its fixed-size cur_alt array.

Pass the decoded and validated interface number to the callbacks.  This
matches the callback contract and prevents an out-of-bounds cur_alt
access when the high byte of wIndex is nonzero.

Fixes: 2f550553e23c ("usb: gadget: f_fs: Add the missing get_alt callback")
Reported-by: Chris Mason <clm@meta.com>
Link: https://lore.kernel.org/r/3984c9bd-2ac8-424e-9390-7170fdab3c03@meta.com
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/usb/gadget/composite.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index df39e3487..2aa07eafc 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1930,7 +1930,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 			break;
 
 		spin_lock(&cdev->lock);
-		value = f->set_alt(f, w_index, w_value);
+		value = f->set_alt(f, intf, w_value);
 		if (value == USB_GADGET_DELAYED_STATUS) {
 			DBG(cdev,
 			 "%s: interface %d (%s) requested delayed status\n",
@@ -1950,7 +1950,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 		if (!f)
 			break;
 		/* lots of interfaces only need altsetting zero... */
-		value = f->get_alt ? f->get_alt(f, w_index) : 0;
+		value = f->get_alt ? f->get_alt(f, intf) : 0;
 		if (value < 0)
 			break;
 		*((u8 *)req->buf) = value;
-- 
2.43.0

Re: [PATCH] usb: gadget: composite: pass the validated interface index

[Aldo Ariel Panzardo]

Hi Greg,

Friendly ping on these five USB gadget patches, all sent September 15:

  - usb: gadget: composite: pass the validated interface index
  - usb: gadget: configfs: zero-terminate Unicode property data
  - usb: gadget: f_printer: use the active RX list in soft reset
  - usb: gadget: ncm: validate NDP length against the NTB
  - [v2] usb: gadget: ncm: validate the NDP chain before parsing
    (v2 incorporates the cyclic chain example from prior review)

Let me know if any of them need changes.

Thanks,
Aldo

Re: [PATCH] usb: gadget: composite: pass the validated interface index

[Greg Kroah-Hartman]

On Fri, Oct 09, 2026 at 12:02:44AM -0300, Aldo Ariel Panzardo wrote:
> Hi Greg,
> 
> Friendly ping on these five USB gadget patches, all sent September 15:
> 
>   - usb: gadget: composite: pass the validated interface index
>   - usb: gadget: configfs: zero-terminate Unicode property data
>   - usb: gadget: f_printer: use the active RX list in soft reset
>   - usb: gadget: ncm: validate NDP length against the NTB
>   - [v2] usb: gadget: ncm: validate the NDP chain before parsing
>     (v2 incorporates the cyclic chain example from prior review)
> 
> Let me know if any of them need changes.

I am way behind on patches due to travel and the influx of all of these.
Please help out by reviewing other patches on the list to help reduce
the load so that your patches can be gotten to...

thanks,

greg k-h

Re: [PATCH] usb: gadget: composite: pass the validated interface index

[Greg Kroah-Hartman]

On Sat, Oct 24, 2026 at 05:54:02PM -0300, Aldo Ariel wrote:
> Hi Greg,

Hi, please don't top-post or send html email as the mailing list will
reject that.

> Following up on the five gadget fixes in this thread.
> 
> I understand there is a review backlog. Is there any additional
> testing or other work I can do to help with these patches?

Yes please review other gadget driver patches that are pending to help
move yours up.  also note that nothing can really happen until after
-rc1 is out.  Is there some rush for these patches that you are hitting
in a real device right now that requires these to be fixed sooner?

thanks,

greg k-h

Re: [PATCH] usb: gadget: composite: pass the validated interface index

[Aldo Ariel Panzardo]

On Sun, 25 Oct 2026 07:30:12 +0100, Greg Kroah-Hartman wrote:
> Hi, please don't top-post or send html email as the mailing list will
> reject that.

Sorry about that, I sent the previous message from the Gmail app
which defaults to HTML.  I will stick to git send-email from now on.

> Yes please review other gadget driver patches that are pending to help
> move yours up.  also note that nothing can really happen until after
> -rc1 is out.  Is there some rush for these patches that you are hitting
> in a real device right now that requires these to be fixed sooner?

No rush at all, these are from code audit, not hitting them on a
real device.  I will keep reviewing pending patches on the list
in the meantime -- just looking to help where I can.

Thanks,
Aldo