1. Patchew
  2. linux
  3. View series

[PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc

Ma Ke posted 1 patch 1 year, 5 months ago 
drivers/usb/gadget/udc/r8a66597-udc.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
[PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
Posted by Ma Ke 1 year, 5 months ago 
We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.

Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/usb/gadget/udc/r8a66597-udc.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index db4a10a979f9..93fc4201c0ae 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1173,7 +1173,11 @@ __acquires(r8a66597->lock)
 		status = 0;
 		break;
 	case USB_RECIP_ENDPOINT:
-		ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+		int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
+
+		if (pipe >= USB_MAX_ENDPOINTS)
+			break;
+		ep = r8a66597->epaddr2ep[pipe];
 		pid = control_reg_get_pid(r8a66597, ep->pipenum);
 		if (pid == PID_STALL)
 			status = 1 << USB_ENDPOINT_HALT;
@@ -1208,8 +1212,11 @@ static void clear_feature(struct r8a66597 *r8a66597,
 		struct r8a66597_ep *ep;
 		struct r8a66597_request *req;
 		u16 w_index = le16_to_cpu(ctrl->wIndex);
+		int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
 
-		ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+		if (pipe >= USB_MAX_ENDPOINTS)
+			break;
+		ep = r8a66597->epaddr2ep[pipe];
 		if (!ep->wedge) {
 			pipe_stop(r8a66597, ep->pipenum);
 			control_reg_sqclr(r8a66597, ep->pipenum);
@@ -1268,8 +1275,11 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
 	case USB_RECIP_ENDPOINT: {
 		struct r8a66597_ep *ep;
 		u16 w_index = le16_to_cpu(ctrl->wIndex);
+		int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
 
-		ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+		if (pipe >= USB_MAX_ENDPOINTS)
+			break;
+		ep = r8a66597->epaddr2ep[pipe];
 		pipe_stall(r8a66597, ep->pipenum);
 
 		control_end(r8a66597, 1);
-- 
2.25.1
Re: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
Posted by kernel test robot 1 year, 5 months ago 
Hi Ma,

kernel test robot noticed the following build errors:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v6.10-rc5 next-20240625]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/usb-gadget-r8a66597-udc-validate-endpoint-index-for-r8a66597-udc/20240626-003228
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20240622142308.1929531-1-make24%40iscas.ac.cn
patch subject: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
config: i386-buildonly-randconfig-005-20240626 (https://download.01.org/0day-ci/archive/20240626/202406261324.4izkBtpK-lkp@intel.com/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240626/202406261324.4izkBtpK-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406261324.4izkBtpK-lkp@intel.com/

All error/warnings (new ones prefixed by >>):

>> drivers/usb/gadget/udc/r8a66597-udc.c:1176:3: warning: label followed by a declaration is a C23 extension [-Wc23-extensions]
    1176 |                 int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
         |                 ^
>> drivers/usb/gadget/udc/r8a66597-udc.c:1178:15: error: use of undeclared identifier 'USB_MAX_ENDPOINTS'
    1178 |                 if (pipe >= USB_MAX_ENDPOINTS)
         |                             ^
   drivers/usb/gadget/udc/r8a66597-udc.c:1217:15: error: use of undeclared identifier 'USB_MAX_ENDPOINTS'
    1217 |                 if (pipe >= USB_MAX_ENDPOINTS)
         |                             ^
   drivers/usb/gadget/udc/r8a66597-udc.c:1280:15: error: use of undeclared identifier 'USB_MAX_ENDPOINTS'
    1280 |                 if (pipe >= USB_MAX_ENDPOINTS)
         |                             ^
   1 warning and 3 errors generated.


vim +/USB_MAX_ENDPOINTS +1178 drivers/usb/gadget/udc/r8a66597-udc.c

  1158	
  1159	static void get_status(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
  1160	__releases(r8a66597->lock)
  1161	__acquires(r8a66597->lock)
  1162	{
  1163		struct r8a66597_ep *ep;
  1164		u16 pid;
  1165		u16 status = 0;
  1166		u16 w_index = le16_to_cpu(ctrl->wIndex);
  1167	
  1168		switch (ctrl->bRequestType & USB_RECIP_MASK) {
  1169		case USB_RECIP_DEVICE:
  1170			status = r8a66597->device_status;
  1171			break;
  1172		case USB_RECIP_INTERFACE:
  1173			status = 0;
  1174			break;
  1175		case USB_RECIP_ENDPOINT:
> 1176			int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
  1177	
> 1178			if (pipe >= USB_MAX_ENDPOINTS)
  1179				break;
  1180			ep = r8a66597->epaddr2ep[pipe];
  1181			pid = control_reg_get_pid(r8a66597, ep->pipenum);
  1182			if (pid == PID_STALL)
  1183				status = 1 << USB_ENDPOINT_HALT;
  1184			else
  1185				status = 0;
  1186			break;
  1187		default:
  1188			pipe_stall(r8a66597, 0);
  1189			return;		/* exit */
  1190		}
  1191	
  1192		r8a66597->ep0_data = cpu_to_le16(status);
  1193		r8a66597->ep0_req->buf = &r8a66597->ep0_data;
  1194		r8a66597->ep0_req->length = 2;
  1195		/* AV: what happens if we get called again before that gets through? */
  1196		spin_unlock(&r8a66597->lock);
  1197		r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
  1198		spin_lock(&r8a66597->lock);
  1199	}
  1200	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Re: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
Posted by kernel test robot 1 year, 5 months ago 
Hi Ma,

kernel test robot noticed the following build errors:

[auto build test ERROR on usb/usb-testing]
[also build test ERROR on usb/usb-next usb/usb-linus linus/master v6.10-rc5 next-20240625]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/usb-gadget-r8a66597-udc-validate-endpoint-index-for-r8a66597-udc/20240626-003228
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20240622142308.1929531-1-make24%40iscas.ac.cn
patch subject: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
config: i386-buildonly-randconfig-004-20240626 (https://download.01.org/0day-ci/archive/20240626/202406261220.OagNp3Mb-lkp@intel.com/config)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240626/202406261220.OagNp3Mb-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202406261220.OagNp3Mb-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/usb/gadget/udc/r8a66597-udc.c: In function 'get_status':
>> drivers/usb/gadget/udc/r8a66597-udc.c:1178:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'?
    1178 |                 if (pipe >= USB_MAX_ENDPOINTS)
         |                             ^~~~~~~~~~~~~~~~~
         |                             USB_DT_ENDPOINT
   drivers/usb/gadget/udc/r8a66597-udc.c:1178:29: note: each undeclared identifier is reported only once for each function it appears in
   drivers/usb/gadget/udc/r8a66597-udc.c: In function 'clear_feature':
   drivers/usb/gadget/udc/r8a66597-udc.c:1217:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'?
    1217 |                 if (pipe >= USB_MAX_ENDPOINTS)
         |                             ^~~~~~~~~~~~~~~~~
         |                             USB_DT_ENDPOINT
   drivers/usb/gadget/udc/r8a66597-udc.c: In function 'set_feature':
   drivers/usb/gadget/udc/r8a66597-udc.c:1280:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'?
    1280 |                 if (pipe >= USB_MAX_ENDPOINTS)
         |                             ^~~~~~~~~~~~~~~~~
         |                             USB_DT_ENDPOINT


vim +1178 drivers/usb/gadget/udc/r8a66597-udc.c

  1158	
  1159	static void get_status(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
  1160	__releases(r8a66597->lock)
  1161	__acquires(r8a66597->lock)
  1162	{
  1163		struct r8a66597_ep *ep;
  1164		u16 pid;
  1165		u16 status = 0;
  1166		u16 w_index = le16_to_cpu(ctrl->wIndex);
  1167	
  1168		switch (ctrl->bRequestType & USB_RECIP_MASK) {
  1169		case USB_RECIP_DEVICE:
  1170			status = r8a66597->device_status;
  1171			break;
  1172		case USB_RECIP_INTERFACE:
  1173			status = 0;
  1174			break;
  1175		case USB_RECIP_ENDPOINT:
  1176			int pipe = w_index & USB_ENDPOINT_NUMBER_MASK;
  1177	
> 1178			if (pipe >= USB_MAX_ENDPOINTS)
  1179				break;
  1180			ep = r8a66597->epaddr2ep[pipe];
  1181			pid = control_reg_get_pid(r8a66597, ep->pipenum);
  1182			if (pid == PID_STALL)
  1183				status = 1 << USB_ENDPOINT_HALT;
  1184			else
  1185				status = 0;
  1186			break;
  1187		default:
  1188			pipe_stall(r8a66597, 0);
  1189			return;		/* exit */
  1190		}
  1191	
  1192		r8a66597->ep0_data = cpu_to_le16(status);
  1193		r8a66597->ep0_req->buf = &r8a66597->ep0_data;
  1194		r8a66597->ep0_req->length = 2;
  1195		/* AV: what happens if we get called again before that gets through? */
  1196		spin_unlock(&r8a66597->lock);
  1197		r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC);
  1198		spin_lock(&r8a66597->lock);
  1199	}
  1200	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Re: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc
Posted by Markus Elfring 1 year, 5 months ago 
> We should verify the bound of the array to assure that host
> may not manipulate the index to point past endpoint array.

* Can an imperative wording be more desirable for such a change description?
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.10-rc4#n94

* Will any tags (like “Fixes”) become relevant here?

Regards,
Markus

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.