Re: [PATCH] usb: gadget: r8a66597: fix NULL dereference for unmapped endpoints

[sashiko-bot@kernel.org]

> The epaddr2ep[] table is initialized with EP0 at probe time and
> populated for other endpoints when the gadget driver successfully
> enables them.  Entries for endpoint numbers that have never been
> enabled remain NULL.  The table is indexed by endpoint number and the
> lookup mask is USB_ENDPOINT_NUMBER_MASK, so the access itself stays in
> bounds; what is missing is the check for the NULL entry.
> 
> get_status(), clear_feature() and set_feature() index this table using
> the host-controlled wIndex and immediately dereference the result
> without checking it.  A malicious host can send a standard
> endpoint-recipient GET_STATUS, CLEAR_FEATURE or SET_FEATURE request for
> an unmapped endpoint number, triggering a NULL pointer dereference and
> crashing the kernel.
> 
> Check the looked-up endpoint before using it.  If the entry is NULL,
> stall the control pipe (pipe_stall(r8a66597, 0)) and abort the request,
> matching the existing handling of unsupported recipients.
> 
> Fixes: c41442474a26 ("usb: gadget: R8A66597 peripheral controller support.")
> Cc: stable@vger.kernel.org
> Reviewed-by: Liu Chao <liuc63@xiaopeng.com>
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111030206.64608-1-fangxy@xiaopeng.com?part=1