ep0_handle_status() and ep0_handle_feature() derive an endpoint index
from the host-supplied wIndex field:

    epnum = wIndex & USB_ENDPOINT_NUMBER_MASK;  /* 0 .. 15 */
    epnum = epnum * 2 + 1;                      /* up to 31 */
    ep = bdc->bdc_ep_array[epnum];

bdc_ep_array[] is allocated with bdc->num_eps entries (typically 10-16
depending on the hardware).  A malicious USB host can set wIndex to a
value that produces an epnum beyond num_eps, causing an out-of-bounds
read of a stale or uninitialized pointer, followed by a dereference.

Add a bounds check before the array access in both functions, matching
the same pattern already used in bdc_sr_xsf() since commit a402532ab855
("usb: gadget: bdc: validate status-report endpoint indices").

Fixes: efed421a94e6 ("usb: gadget: Add Broadcom BDC UDC driver")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/bdc/bdc_ep.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c
index a7a22e5ec..e5c203b9a 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_ep.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c
@@ -1286,6 +1286,10 @@ static int ep0_handle_feature(struct bdc *bdc,
 			return 0;
 		}
 		dev_dbg(bdc->dev, "epnum=%d\n", epnum);
+		if (epnum >= bdc->num_eps) {
+			dev_err(bdc->dev, "Invalid ep index %d\n", epnum);
+			return -EINVAL;
+		}
 		ep = bdc->bdc_ep_array[epnum];
 		if (!ep)
 			return -EINVAL;
@@ -1352,6 +1356,10 @@ static int ep0_handle_status(struct bdc *bdc,
 			epnum = 1; /* EP0 */
 		}
 
+		if (epnum >= bdc->num_eps) {
+			dev_err(bdc->dev, "Invalid ep index %d\n", epnum);
+			return -EINVAL;
+		}
 		ep = bdc->bdc_ep_array[epnum];
 		if (!ep) {
 			dev_err(bdc->dev, "ISSUE, GET_STATUS for invalid EP ?");
-- 
2.50.1