Commit ce9daa2e authored by Ma Ke's avatar Ma Ke Committed by Greg Kroah-Hartman
Browse files

usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc 



We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.

Signed-off-by: default avatarMa Ke <make_ruc2021@163.com>
Acked-by: default avatarLi Yang <leoyang.li@nxp.com>
Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e032368e

drivers/usb/gadget/udc/fsl_qe_udc.c

+2 −0
Original line number Diff line number Diff line
@@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, 
	} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {

		/* Get endpoint status */

		int pipe = index & USB_ENDPOINT_NUMBER_MASK;

		if (pipe >= USB_MAX_ENDPOINTS)

			goto stall;

		struct qe_ep *target_ep = &udc->eps[pipe];

		u16 usep;