Unverified Commit a1c0be74 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12380 fix CVE-2024-46675 

Merge Pull Request from: @ci-robot 
 
PR sync from: Lin Ruifeng <linruifeng4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/GCPQAJK6ZDFCPGX55UH4SZFGG3Q4DUDX/ 
fix CVE-2024-46675

Krishna Kurapati (1):
  usb: dwc3: core: Skip setting event buffers for host only controllers

Selvarasu Ganesan (1):
  usb: dwc3: core: Prevent USB core invalid event buffer address access


-- 
2.17.1
 
https://gitee.com/src-openeuler/kernel/issues/IAR5YA
https://gitee.com/src-openeuler/kernel/issues/ 
 
Link:https://gitee.com/openeuler/kernel/pulls/12380

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents d2a40c79 f5f5ee8a

drivers/usb/dwc3/core.c

+21 −0
Original line number Diff line number Diff line
@@ -388,6 +388,13 @@ static void dwc3_free_event_buffers(struct dwc3 *dwc) 
static int dwc3_alloc_event_buffers(struct dwc3 *dwc, unsigned length)

{

	struct dwc3_event_buffer *evt;

	unsigned int hw_mode;



	hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);

	if (hw_mode == DWC3_GHWPARAMS0_MODE_HOST) {

		dwc->ev_buf = NULL;

		return 0;

	}



	evt = dwc3_alloc_one_event_buffer(dwc, length);

	if (IS_ERR(evt)) {
@@ -409,6 +416,9 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc) 
{

	struct dwc3_event_buffer	*evt;



	if (!dwc->ev_buf)

		return 0;



	evt = dwc->ev_buf;

	evt->lpos = 0;

	dwc3_writel(dwc->regs, DWC3_GEVNTADRLO(0),
@@ -425,6 +435,17 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc) 
void dwc3_event_buffers_cleanup(struct dwc3 *dwc)

{

	struct dwc3_event_buffer	*evt;

	u32				reg;



	if (!dwc->ev_buf)

		return;

	/*

	 * Exynos platforms may not be able to access event buffer if the

	 * controller failed to halt on dwc3_core_exit().

	 */

	reg = dwc3_readl(dwc->regs, DWC3_DSTS);

	if (!(reg & DWC3_DSTS_DEVCTRLHLT))

		return;



	evt = dwc->ev_buf;