* [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
@ 2024-06-22 14:23 Ma Ke
2024-06-22 15:30 ` Markus Elfring
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Ma Ke @ 2024-06-22 14:23 UTC (permalink / raw)
To: gregkh, u.kleine-koenig, make24; +Cc: linux-usb, linux-kernel
We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
drivers/usb/gadget/udc/r8a66597-udc.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index db4a10a979f9..93fc4201c0ae 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1173,7 +1173,11 @@ __acquires(r8a66597->lock)
status = 0;
break;
case USB_RECIP_ENDPOINT:
- ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+ int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
+
+ if (pipe >= USB_MAX_ENDPOINTS)
+ break;
+ ep = r8a66597->epaddr2ep[pipe];
pid = control_reg_get_pid(r8a66597, ep->pipenum);
if (pid == PID_STALL)
status = 1 << USB_ENDPOINT_HALT;
@@ -1208,8 +1212,11 @@ static void clear_feature(struct r8a66597 *r8a66597,
struct r8a66597_ep *ep;
struct r8a66597_request *req;
u16 w_index = le16_to_cpu(ctrl->wIndex);
+ int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
- ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+ if (pipe >= USB_MAX_ENDPOINTS)
+ break;
+ ep = r8a66597->epaddr2ep[pipe];
if (!ep->wedge) {
pipe_stop(r8a66597, ep->pipenum);
control_reg_sqclr(r8a66597, ep->pipenum);
@@ -1268,8 +1275,11 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
case USB_RECIP_ENDPOINT: {
struct r8a66597_ep *ep;
u16 w_index = le16_to_cpu(ctrl->wIndex);
+ int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
- ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+ if (pipe >= USB_MAX_ENDPOINTS)
+ break;
+ ep = r8a66597->epaddr2ep[pipe];
pipe_stall(r8a66597, ep->pipenum);
control_end(r8a66597, 1);
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
2024-06-22 14:23 [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc Ma Ke
@ 2024-06-22 15:30 ` Markus Elfring
2024-06-26 4:32 ` kernel test robot
2024-06-26 5:34 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: Markus Elfring @ 2024-06-22 15:30 UTC (permalink / raw)
To: Ma Ke, linux-usb, Greg Kroah-Hartman, Uwe Kleine-König; +Cc: LKML
> We should verify the bound of the array to assure that host
> may not manipulate the index to point past endpoint array.
* Can an imperative wording be more desirable for such a change description?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10-rc4#n94
* Will any tags (like “Fixes”) become relevant here?
Regards,
Markus
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
2024-06-22 14:23 [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc Ma Ke
2024-06-22 15:30 ` Markus Elfring
@ 2024-06-26 4:32 ` kernel test robot
2024-06-26 5:34 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2024-06-26 4:32 UTC (permalink / raw)
To: Ma Ke, gregkh, u.kleine-koenig; +Cc: oe-kbuild-all, linux-usb, linux-kernel
Hi Ma,
kernel test robot noticed the following build errors:
[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v6.10-rc5 next-20240625]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/usb-gadget-r8a66597-udc-validate-endpoint-index-for-r8a66597-udc/20240626-003228
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/r/20240622142308.1929531-1-make24%40iscas.ac.cn
patch subject: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
config: i386-buildonly-randconfig-004-20240626 (https://download.01.org/0day-ci/archive/20240626/202406261220.OagNp3Mb-lkp@intel.com/config)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240626/202406261220.OagNp3Mb-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406261220.OagNp3Mb-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/usb/gadget/udc/r8a66597-udc.c: In function 'get_status':
>> drivers/usb/gadget/udc/r8a66597-udc.c:1178:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'?
1178 | if (pipe >= USB_MAX_ENDPOINTS)
| ^~~~~~~~~~~~~~~~~
| USB_DT_ENDPOINT
drivers/usb/gadget/udc/r8a66597-udc.c:1178:29: note: each undeclared identifier is reported only once for each function it appears in
drivers/usb/gadget/udc/r8a66597-udc.c: In function 'clear_feature':
drivers/usb/gadget/udc/r8a66597-udc.c:1217:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'?
1217 | if (pipe >= USB_MAX_ENDPOINTS)
| ^~~~~~~~~~~~~~~~~
| USB_DT_ENDPOINT
drivers/usb/gadget/udc/r8a66597-udc.c: In function 'set_feature':
drivers/usb/gadget/udc/r8a66597-udc.c:1280:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'?
1280 | if (pipe >= USB_MAX_ENDPOINTS)
| ^~~~~~~~~~~~~~~~~
| USB_DT_ENDPOINT
vim +1178 drivers/usb/gadget/udc/r8a66597-udc.c
1158
1159 static void get_status(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
1160 __releases(r8a66597->lock)
1161 __acquires(r8a66597->lock)
1162 {
1163 struct r8a66597_ep *ep;
1164 u16 pid;
1165 u16 status = 0;
1166 u16 w_index = le16_to_cpu(ctrl->wIndex);
1167
1168 switch (ctrl->bRequestType & USB_RECIP_MASK) {
1169 case USB_RECIP_DEVICE:
1170 status = r8a66597->device_status;
1171 break;
1172 case USB_RECIP_INTERFACE:
1173 status = 0;
1174 break;
1175 case USB_RECIP_ENDPOINT:
1176 int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
1177
> 1178 if (pipe >= USB_MAX_ENDPOINTS)
1179 break;
1180 ep = r8a66597->epaddr2ep[pipe];
1181 pid = control_reg_get_pid(r8a66597, ep->pipenum);
1182 if (pid == PID_STALL)
1183 status = 1 << USB_ENDPOINT_HALT;
1184 else
1185 status = 0;
1186 break;
1187 default:
1188 pipe_stall(r8a66597, 0);
1189 return; /* exit */
1190 }
1191
1192 r8a66597->ep0_data = cpu_to_le16(status);
1193 r8a66597->ep0_req->buf = &r8a66597->ep0_data;
1194 r8a66597->ep0_req->length = 2;
1195 /* AV: what happens if we get called again before that gets through? */
1196 spin_unlock(&r8a66597->lock);
1197 r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
1198 spin_lock(&r8a66597->lock);
1199 }
1200
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
2024-06-22 14:23 [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc Ma Ke
2024-06-22 15:30 ` Markus Elfring
2024-06-26 4:32 ` kernel test robot
@ 2024-06-26 5:34 ` kernel test robot
2 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2024-06-26 5:34 UTC (permalink / raw)
To: Ma Ke, gregkh, u.kleine-koenig
Cc: llvm, oe-kbuild-all, linux-usb, linux-kernel
Hi Ma,
kernel test robot noticed the following build errors:
[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v6.10-rc5 next-20240625]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/usb-gadget-r8a66597-udc-validate-endpoint-index-for-r8a66597-udc/20240626-003228
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/r/20240622142308.1929531-1-make24%40iscas.ac.cn
patch subject: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
config: i386-buildonly-randconfig-005-20240626 (https://download.01.org/0day-ci/archive/20240626/202406261324.4izkBtpK-lkp@intel.com/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240626/202406261324.4izkBtpK-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406261324.4izkBtpK-lkp@intel.com/
All error/warnings (new ones prefixed by >>):
>> drivers/usb/gadget/udc/r8a66597-udc.c:1176:3: warning: label followed by a declaration is a C23 extension [-Wc23-extensions]
1176 | int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
| ^
>> drivers/usb/gadget/udc/r8a66597-udc.c:1178:15: error: use of undeclared identifier 'USB_MAX_ENDPOINTS'
1178 | if (pipe >= USB_MAX_ENDPOINTS)
| ^
drivers/usb/gadget/udc/r8a66597-udc.c:1217:15: error: use of undeclared identifier 'USB_MAX_ENDPOINTS'
1217 | if (pipe >= USB_MAX_ENDPOINTS)
| ^
drivers/usb/gadget/udc/r8a66597-udc.c:1280:15: error: use of undeclared identifier 'USB_MAX_ENDPOINTS'
1280 | if (pipe >= USB_MAX_ENDPOINTS)
| ^
1 warning and 3 errors generated.
vim +/USB_MAX_ENDPOINTS +1178 drivers/usb/gadget/udc/r8a66597-udc.c
1158
1159 static void get_status(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
1160 __releases(r8a66597->lock)
1161 __acquires(r8a66597->lock)
1162 {
1163 struct r8a66597_ep *ep;
1164 u16 pid;
1165 u16 status = 0;
1166 u16 w_index = le16_to_cpu(ctrl->wIndex);
1167
1168 switch (ctrl->bRequestType & USB_RECIP_MASK) {
1169 case USB_RECIP_DEVICE:
1170 status = r8a66597->device_status;
1171 break;
1172 case USB_RECIP_INTERFACE:
1173 status = 0;
1174 break;
1175 case USB_RECIP_ENDPOINT:
> 1176 int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
1177
> 1178 if (pipe >= USB_MAX_ENDPOINTS)
1179 break;
1180 ep = r8a66597->epaddr2ep[pipe];
1181 pid = control_reg_get_pid(r8a66597, ep->pipenum);
1182 if (pid == PID_STALL)
1183 status = 1 << USB_ENDPOINT_HALT;
1184 else
1185 status = 0;
1186 break;
1187 default:
1188 pipe_stall(r8a66597, 0);
1189 return; /* exit */
1190 }
1191
1192 r8a66597->ep0_data = cpu_to_le16(status);
1193 r8a66597->ep0_req->buf = &r8a66597->ep0_data;
1194 r8a66597->ep0_req->length = 2;
1195 /* AV: what happens if we get called again before that gets through? */
1196 spin_unlock(&r8a66597->lock);
1197 r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
1198 spin_lock(&r8a66597->lock);
1199 }
1200
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-06-26 5:35 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-22 14:23 [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc Ma Ke
2024-06-22 15:30 ` Markus Elfring
2024-06-26 4:32 ` kernel test robot
2024-06-26 5:34 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox