Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ebc465e8 authored by Szymon Heidrich's avatar Szymon Heidrich Committed by Greg Kroah-Hartman
Browse files

USB: gadget: validate endpoint index for xilinx udc 



commit 7f14c7227f342d9932f9b918893c8814f86d2a0d upstream.

Assure that host may not manipulate the index to point
past endpoint array.

Signed-off-by: default avatarSzymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9f688aad

drivers/usb/gadget/udc/udc-xilinx.c

+6 −0
Original line number Original line Diff line number Diff line
@@ -1613,6 +1613,8 @@ static void xudc_getstatus(struct xusb_udc *udc) 
		break;

		break;

	case USB_RECIP_ENDPOINT:

	case USB_RECIP_ENDPOINT:

		epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;

		epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;

		if (epnum >= XUSB_MAX_ENDPOINTS)

			goto stall;

		target_ep = &udc->ep[epnum];

		target_ep = &udc->ep[epnum];

		epcfgreg = udc->read_fn(udc->addr + target_ep->offset);

		epcfgreg = udc->read_fn(udc->addr + target_ep->offset);

		halt = epcfgreg & XUSB_EP_CFG_STALL_MASK;

		halt = epcfgreg & XUSB_EP_CFG_STALL_MASK;
@@ -1680,6 +1682,10 @@ static void xudc_set_clear_feature(struct xusb_udc *udc) 
	case USB_RECIP_ENDPOINT:

	case USB_RECIP_ENDPOINT:

		if (!udc->setup.wValue) {

		if (!udc->setup.wValue) {

			endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;

			endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;

			if (endpoint >= XUSB_MAX_ENDPOINTS) {

				xudc_ep0_stall(udc);

				return;

			}

			target_ep = &udc->ep[endpoint];

			target_ep = &udc->ep[endpoint];

			outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK;

			outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK;

			outinbit = outinbit >> 7;

			outinbit = outinbit >> 7;