From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062856; b=5LFkQIRy0OYjBD2jyvbmATKVwgL9BgMMInrCgUGkir9Gr5i+2ARxtqsou6htyc+gnryl Kvz3ZdoXOJa2uiQ7gPJxv8slr2x4rLnVnJbmvAwirk4vyl3APiO9+LHf1n1CVv8xqUl0I /xPOzRJFANcT9Et2kjH/oDxU+rWYogukxoZKcCOljmtM4rz4VrOUkVAuUQHXtFoleZFk8 CTPxPy37VlpTncfzg2hf/wHsKIYYuHQUpyiuXJxbtaFs0VFBC8T/7sLx1OPhe8YjXlSrV 206uHXuR8Xo/TBdTlDezh0BflnYYkZOE0QAXj5Ed8jymYB2dG1tXyOiSpOPWPjHHs+Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062856; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=3sHxnvGjE70PlHyapz3zGQD3jfYEw2YrgLblm6zOuks=; b=Zzqp2hnTiuPPgRjEngJHpwFKcbyC11X1VogtMCSSXp9iVHcZvh+Tm8Tr5dS+VnhdgCw6 bL21eFKE/NGWXBV15X1BnlvL2MJWrdJEuouBlyrBS9295Q/h2Jcb+HFibU5imGs0d1g4j /hHZi3vWwAE7VG7ILCtk8o+HQZQZ/76NXDGVYMOB4ZGwGBLoNtqlGfSh6Y/KRG4mPzQid /d9tbxF8prxgqaXF9Nbd+ewmQ6BTh16HIzY2g8P6mnkyGy8jPMuBn948NPV+L0tRoL0Nu AY2RUXTjuMv6L3T4ZS5q3FPAvMXpntva/HvbQP1ap7Vu7oI/ztLBKRWYy4qFZPTprHQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Jsf3sZKj; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DCD8606A334; Sat, 7 Nov 2026 14:47:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Jsf3sZKj Received: by smtp.kernel.org (Postfix) with ESMTPSA id 182251F0089F; Sat, 7 Nov 2026 14:47:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062856; bh=3sHxnvGjE70PlHyapz3zGQD3jfYEw2YrgLblm6zOuks=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Jsf3sZKjalMtIdGmffA6QvH7r5Ok+NriVurq7bIQwsTv13SFoJmnb6tYL24hy85v+ qn116F7PoktfkB+M7W7AhV+dCuYCADhppLka9XMmKeYpdlGLT+qLc27G2ApEGfLrFP 4lYc/43wN5BG+Y1DcI4qL9u4OnOA9Kn711mAOTiI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Liu Chao , Linus Walleij , Sasha Levin Subject: [PATCH 6.18 146/869] usb: fotg210: validate endpoint index in ep0 handlers Date: Sat, 7 Nov 2026 08:47:08 -0500 Message-ID: <20261107134857.314941623@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Liu Chao [ Upstream commit bbddb219b00af0792242a0ad1dc7fb3344f38733 ] fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status() use wIndex from the USB setup packet to index the fotg210->ep[] array without verifying that the endpoint number falls below FOTG210_MAX_NUM_EP (5). USB_ENDPOINT_NUMBER_MASK is 0x0f, so a malicious host can issue a setup packet with wIndex 5..15, resulting in an out-of-bounds array read. The resulting wild pointer is then dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which compute an MMIO register offset from ep->epnum and perform iowrite32 through it. fotg210_clear_feature() is especially problematic: the out-of-bounds access occurs at function entry (source-level) regardless of which USB_RECIP_* case is taken, because the ep pointer is computed before the switch statement. Add upper-bound checks on the endpoint number derived from wIndex in all three functions. Invalid endpoint numbers in clear_feature now trigger fotg210_request_error() (STALL) instead of silently falling through to fotg210_set_cxdone(). Also add the missing le16_to_cpu() conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse endianness warning. Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") Cc: stable@vger.kernel.org Signed-off-by: Liu Chao Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260913120458.1608186-1-liuc63@xiaopeng.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/fotg210/fotg210-udc.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c index 0bae12e34f9a7..26f29dba58f27 100644 --- a/drivers/usb/fotg210/fotg210-udc.c +++ b/drivers/usb/fotg210/fotg210-udc.c @@ -661,7 +661,7 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210, case USB_RECIP_ENDPOINT: { u8 epnum; epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK; - if (epnum) + if (epnum && epnum < FOTG210_MAX_NUM_EP) fotg210_set_epnstall(fotg210->ep[epnum]); else fotg210_set_cxstall(fotg210); @@ -677,8 +677,8 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210, static void fotg210_clear_feature(struct fotg210_udc *fotg210, struct usb_ctrlrequest *ctrl) { - struct fotg210_ep *ep = - fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK]; + u8 epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK; + struct fotg210_ep *ep; switch (ctrl->bRequestType & USB_RECIP_MASK) { case USB_RECIP_DEVICE: @@ -688,7 +688,12 @@ static void fotg210_clear_feature(struct fotg210_udc *fotg210, fotg210_set_cxdone(fotg210); break; case USB_RECIP_ENDPOINT: - if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) { + if (epnum >= FOTG210_MAX_NUM_EP) { + fotg210_request_error(fotg210); + break; + } + if (epnum) { + ep = fotg210->ep[epnum]; if (ep->wedged) { fotg210_set_cxdone(fotg210); break; @@ -744,8 +749,8 @@ static void fotg210_get_status(struct fotg210_udc *fotg210, fotg210->ep0_data = cpu_to_le16(0); break; case USB_RECIP_ENDPOINT: - epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK; - if (epnum) + epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK; + if (epnum && epnum < FOTG210_MAX_NUM_EP) fotg210->ep0_data = cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum]) << USB_ENDPOINT_HALT); -- 2.53.0