Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-24 21:54:01 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix out of bound access of ep array.

Browse source 
When processing USB_REQ_CLEAR_FEATURE, USB_REQ_SET_FEATURE, and
USB_REQ_GET_STATUS packets in dwc2_ep0_setup an out of bounds access
can occur. This is caused by the wIndex field of the usb control packet
being used as an index into an array whose size is DWC2_MAX_ENDPOINTS (4).

Signed-off-by: Alison Huffman <alisn@google.com>
This commit is contained in:
Alison Huffman 2022-09-22 04:01:32 +00:00 committed by Marek Vasut
parent 693765a720
commit 206af3dec0
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/usb/gadget/dwc2_udc_otg_xfer_dma.c
View file

@ -890,7 +890,7 @@ static int dwc2_ep0_write(struct dwc2_udc *dev)
static int dwc2_udc_get_status(struct dwc2_udc *dev, static int dwc2_udc_get_status(struct dwc2_udc *dev,
struct usb_ctrlrequest *crq) struct usb_ctrlrequest *crq)
{ {
u8 ep_num = crq->wIndex & 0x7F; u8 ep_num = crq->wIndex & 0x3;
u16 g_status = 0; u16 g_status = 0;
u32 ep_ctrl; u32 ep_ctrl;
@ -1418,7 +1418,7 @@ static void dwc2_ep0_setup(struct dwc2_udc *dev)
break; break;
case USB_REQ_CLEAR_FEATURE: case USB_REQ_CLEAR_FEATURE:
ep_num = usb_ctrl->wIndex & 0x7f; ep_num = usb_ctrl->wIndex & 0x3;
if (!dwc2_udc_clear_feature(&dev->ep[ep_num].ep)) if (!dwc2_udc_clear_feature(&dev->ep[ep_num].ep))
return; return;
@ -1426,7 +1426,7 @@ static void dwc2_ep0_setup(struct dwc2_udc *dev)
break; break;
case USB_REQ_SET_FEATURE: case USB_REQ_SET_FEATURE:
ep_num = usb_ctrl->wIndex & 0x7f; ep_num = usb_ctrl->wIndex & 0x3;
if (!dwc2_udc_set_feature(&dev->ep[ep_num].ep)) if (!dwc2_udc_set_feature(&dev->ep[ep_num].ep))
return; return;