ch9getstatus() uses get_pipe_by_windex() to compute a pipe index from
the host-supplied wIndex field and then passes it to get_ep_by_pipe()
to index the udc->eps[] array. get_pipe_by_windex() can return up to
31, but udc->eps[] is allocated with udc->max_ep entries (typically
8-16 depending on the hardware).
The SET/CLEAR_FEATURE handler in the same function already checks
'pipe >= udc->max_ep' (line 1431) before indexing, but the GET_STATUS
path omits this check, allowing an out-of-bounds access.
Add the same pipe >= max_ep guard to the GET_STATUS endpoint path,
matching the existing check in the feature handler.
Fixes: b504882df105 ("USB: add Freescale high-speed USB SOC device controller driver")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
drivers/usb/gadget/udc/fsl_udc_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index 20392409a..ed70cc650 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -1344,8 +1344,12 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value,
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
struct fsl_ep *target_ep;
+ int pipe = get_pipe_by_windex(index);
- target_ep = get_ep_by_pipe(udc, get_pipe_by_windex(index));
+ if (pipe >= udc->max_ep)
+ goto stall;
+
+ target_ep = get_ep_by_pipe(udc, pipe);
/* stall if endpoint doesn't exist */
if (!target_ep->ep.desc)
--
2.50.1