From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062047; b=GA24PSo/A1xJJ61quJsJff1p3AYXwPkc9C/uz8VuiUMBnKxlLSHc2hC29K/HmvfSDMcv W9mhwzmX8xUbCMldqFM3/7k411VqBiSMGiPBoGqbcwxHCt06H/BQZQ6mf8iBecf7yWhpK EHFcE/9T+xoKZHxcVnp9ak22aC1MMsMpZ4PAQnOSw2gjcK/R2kwhX4S1uTDd1KtbV+lCb 1GSpk3uPGokNUCrvpeVxh6+TIyziA0sq9TiWLCcRe90P6MYPAcqwJfUCIi1KC8V0wJvJC VJRjkG6TeeP31+mNWr2ublnWBkw7IsQM80+DYdTE6NgeTgW43UVNoKpOUTlGd877E5A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062047; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=MFiW0qG71Nt3bOlHcSUrDRpMUwxilakD3J24kV6LKa0=; b=vs1SAlKvZCGsOeEtsHX/Z4+ixNn6YVCUDNjELoSTJAhcU6pDJXexblTO4gmUIR3DRrMu Er/Gaa9QNVuK9ZZDgpJ/rJXeHlsvJ7F6jJ66hZcwiIWcQ4Nhs5cNLbh1jWR9XyDZC4z4Z 2mMFRdO7x+VUn9MFQQPX5Xjf/D5OIXAiv6M4vvyckr2WdkUXzrsJAY5TWnakVwu6qpXBC It64sojaokrZFwwJe6uuFHu12aOI6vDi7r/89d/PmhJN6yXRbpbsZzDQP2gkprBxEpyGo R8gnZLixgI9OlL7Nyor+ytDr8yaGOySYmfMw6ylAd0m38IQokLy5CTmWngNr19/Njtw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="Jk/4YB/M"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1DB56606A334; Sat, 7 Nov 2026 14:34:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Jk/4YB/M Received: by smtp.kernel.org (Postfix) with ESMTPSA id C06311F008BE; Sat, 7 Nov 2026 14:34:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062047; bh=MFiW0qG71Nt3bOlHcSUrDRpMUwxilakD3J24kV6LKa0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Jk/4YB/MeQHfgNBG5BFOSAucDWHnAKAhXGQq2LRHwpMBdb76yefVkRn+M1JnsPtAY cq+RIRoIo//M+aMF3Lqj5aMh2o6gPCjzy9jb2lptOeaOy3gFJjs5MXGBZYDBIMq5uy COgzGSuQa1CaNuluuKgcydVGmfmebXe7Rrx6Miqo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Liu Chao , Linus Walleij , Sasha Levin Subject: [PATCH 6.12 0992/1536] usb: fotg210: validate endpoint index in ep0 handlers Date: Sat, 7 Nov 2026 08:50:08 -0500 Message-ID: <20261107135025.520330110@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Liu Chao [ Upstream commit bbddb219b00af0792242a0ad1dc7fb3344f38733 ] fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status() use wIndex from the USB setup packet to index the fotg210->ep[] array without verifying that the endpoint number falls below FOTG210_MAX_NUM_EP (5). USB_ENDPOINT_NUMBER_MASK is 0x0f, so a malicious host can issue a setup packet with wIndex 5..15, resulting in an out-of-bounds array read. The resulting wild pointer is then dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which compute an MMIO register offset from ep->epnum and perform iowrite32 through it. fotg210_clear_feature() is especially problematic: the out-of-bounds access occurs at function entry (source-level) regardless of which USB_RECIP_* case is taken, because the ep pointer is computed before the switch statement. Add upper-bound checks on the endpoint number derived from wIndex in all three functions. Invalid endpoint numbers in clear_feature now trigger fotg210_request_error() (STALL) instead of silently falling through to fotg210_set_cxdone(). Also add the missing le16_to_cpu() conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse endianness warning. Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") Cc: stable@vger.kernel.org Signed-off-by: Liu Chao Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20260913120458.1608186-1-liuc63@xiaopeng.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/fotg210/fotg210-udc.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c index 0bae12e34f9a7..26f29dba58f27 100644 --- a/drivers/usb/fotg210/fotg210-udc.c +++ b/drivers/usb/fotg210/fotg210-udc.c @@ -661,7 +661,7 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210, case USB_RECIP_ENDPOINT: { u8 epnum; epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK; - if (epnum) + if (epnum && epnum < FOTG210_MAX_NUM_EP) fotg210_set_epnstall(fotg210->ep[epnum]); else fotg210_set_cxstall(fotg210); @@ -677,8 +677,8 @@ static void fotg210_set_feature(struct fotg210_udc *fotg210, static void fotg210_clear_feature(struct fotg210_udc *fotg210, struct usb_ctrlrequest *ctrl) { - struct fotg210_ep *ep = - fotg210->ep[ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK]; + u8 epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK; + struct fotg210_ep *ep; switch (ctrl->bRequestType & USB_RECIP_MASK) { case USB_RECIP_DEVICE: @@ -688,7 +688,12 @@ static void fotg210_clear_feature(struct fotg210_udc *fotg210, fotg210_set_cxdone(fotg210); break; case USB_RECIP_ENDPOINT: - if (ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK) { + if (epnum >= FOTG210_MAX_NUM_EP) { + fotg210_request_error(fotg210); + break; + } + if (epnum) { + ep = fotg210->ep[epnum]; if (ep->wedged) { fotg210_set_cxdone(fotg210); break; @@ -744,8 +749,8 @@ static void fotg210_get_status(struct fotg210_udc *fotg210, fotg210->ep0_data = cpu_to_le16(0); break; case USB_RECIP_ENDPOINT: - epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK; - if (epnum) + epnum = le16_to_cpu(ctrl->wIndex) & USB_ENDPOINT_NUMBER_MASK; + if (epnum && epnum < FOTG210_MAX_NUM_EP) fotg210->ep0_data = cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum]) << USB_ENDPOINT_HALT); -- 2.53.0