From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Seungjin Bae <eeodqql09@gmail.com>
Cc: Kyungtae Kim <Kyungtae.Kim@dartmouth.edu>,
Jassi Brar <jaswinder.singh@linaro.org>,
Felipe Balbi <balbi@kernel.org>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v2 1/2] usb: gadget: max3420_udc: Fix out-of-bounds endpoint index access
Date: Mon, 30 Jun 2025 06:56:09 +0200 [thread overview]
Message-ID: <2025063044-uninvited-simplify-0420@gregkh> (raw)
In-Reply-To: <20250629214943.27893-4-eeodqql09@gmail.com>
On Sun, Jun 29, 2025 at 05:49:45PM -0400, Seungjin Bae wrote:
> In the max3420_set_clear_feature() function, the endpoint index `id` can have a value from 0 to 15.
> However, the udc->ep array is initialized with a maximum of 4 endpoints in max3420_eps_init().
> If host sends a request with a wIndex greater than 3, the access to `udc->ep[id]` will go out-of-bounds,
> leading to memory corruption or a potential kernel crash.
> This bug was found by code inspection and has not been tested on hardware.
Please wrap your lines at 72 columns.
Also, you sent 2 patches, with identical subject lines, but they did
different things. That's not ok as you know.
And I think you really need to test this on hardware. How could that
request ever have a windex set to greater than 3? Is that a hardware
value or a user-controlled value?
thanks,
greg k-h
next prev parent reply other threads:[~2025-06-30 4:56 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-29 20:13 [PATCH] usb: gadget: max3420_udc: Fix out-of-bounds endpoint index access Seungjin Bae
2025-06-29 21:49 ` [PATCH v2 1/2] " Seungjin Bae
2025-06-30 4:56 ` Greg Kroah-Hartman [this message]
2025-07-13 16:05 ` pip-izony
2025-06-29 21:49 ` [PATCH v2 2/2] " Seungjin Bae
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2025063044-uninvited-simplify-0420@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=Kyungtae.Kim@dartmouth.edu \
--cc=balbi@kernel.org \
--cc=eeodqql09@gmail.com \
--cc=jaswinder.singh@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).