Re: [PATCH] usb: dwc3: ep0: fix NULL pointer exception

[Greg KH <greg@kroah.com>]

On Tue, Jun 08, 2021 at 07:26:50PM +0300, Marian-Cristian Rotariu wrote:
> There is no validation of the index from dwc3_wIndex_to_dep() and we might
> be referring a non-existing ep and trigger a NULL pointer exception. In
> certain configurations we might use fewer eps and the index might wrongly
> indicate a larger ep index than existing.
> 
> By adding this validation from the patch we can actually report a wrong
> index back to the caller.
> 
> In our usecase we are using a composite device on an older kernel, but
> upstream might use this fix also. Unfortunately, I cannot describe the
> hardware for others to reproduce the issue as it is a proprietary
> implementation.
> 
> [   82.958261] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a4
> [   82.966891] Mem abort info:
> [   82.969663]   ESR = 0x96000006
> [   82.972703]   Exception class = DABT (current EL), IL = 32 bits
> [   82.978603]   SET = 0, FnV = 0
> [   82.981642]   EA = 0, S1PTW = 0
> [   82.984765] Data abort info:
> [   82.987631]   ISV = 0, ISS = 0x00000006
> [   82.991449]   CM = 0, WnR = 0
> [   82.994409] user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c6210ccc
> [   83.000999] [00000000000000a4] pgd=0000000053aa5003, pud=0000000053aa5003, pmd=0000000000000000
> [   83.009685] Internal error: Oops: 96000006 [#1] PREEMPT SMP
> [   83.026433] Process irq/62-dwc3 (pid: 303, stack limit = 0x000000003985154c)
> [   83.033470] CPU: 0 PID: 303 Comm: irq/62-dwc3 Not tainted 4.19.124 #1
> [   83.044836] pstate: 60000085 (nZCv daIf -PAN -UAO)
> [   83.049628] pc : dwc3_ep0_handle_feature+0x414/0x43c
> [   83.054558] lr : dwc3_ep0_interrupt+0x3b4/0xc94
> 
> ...
> 
> [   83.141788] Call trace:
> [   83.144227]  dwc3_ep0_handle_feature+0x414/0x43c
> [   83.148823]  dwc3_ep0_interrupt+0x3b4/0xc94
> [   83.181546] ---[ end trace aac6b5267d84c32f ]---
> 
> Signed-off-by: Marian-Cristian Rotariu <marian.c.rotariu@gmail.com>
> ---
>  linux-4.19.124/drivers/usb/dwc3/ep0.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/linux-4.19.124/drivers/usb/dwc3/ep0.c b/linux-4.19.124/drivers/usb/dwc3/ep0.c
> index 662a1298b..3a55bbdde 100644
> --- a/linux-4.19.124/drivers/usb/dwc3/ep0.c
> +++ b/linux-4.19.124/drivers/usb/dwc3/ep0.c

How did you create this?  It's one level too "deep" for git.

I'll go edit it by hand, but next time be more careful.

thanks,

greg k-h