leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3d9ae54af1
linux/drivers/usb
History
Heiko Stuebner f670e9f9c8 usb: dwc2: Fix endpoint direction check in ep_from_windex 
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.

In a test-case with a rndis gadget running and sending a malformed
packet to it like:
    dev.ctrl_transfer(
        0x82,      # bmRequestType
        0x00,       # bRequest
        0x0000,     # wValue
        0x0001,     # wIndex
        0x00       # wLength
    )
it is possible to cause a crash:

[  217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[  217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[  218.313189] Call trace:
[  218.330217]  ep_from_windex+0x3c/0x54
[  218.348565]  usb_gadget_giveback_request+0x10/0x20
[  218.368056]  dwc2_hsotg_complete_request+0x144/0x184

This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.

The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.

Fixes: c6f5c050e2 ("usb: dwc2: gadget: add bi-directional endpoint support")
Cc: stable@vger.kernel.org
Reported-by: Gerhard Klostermeier <gerhard.klostermeier@syss.de>
Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Link: https://lore.kernel.org/r/20210127103919.58215-1-heiko@sntech.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-05 10:28:38 +01:00
..
atm drivers: usb: atm: use pr_err() and pr_warn() instead of raw printk() 2020-12-09 15:22:51 +01:00
c67x00 Linux 5.9-rc3 2020-08-31 07:11:45 +02:00
cdns3 usb: cdns3: imx: improve driver .remove API 2020-12-29 13:39:53 +08:00
chipidea usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() 2020-12-28 15:45:53 +01:00
class USB: usblp: don't call usb_set_interface if there's a single alt 2021-01-26 15:15:31 +01:00
common usb: common: ulpi: Constify static attribute_group struct 2020-11-26 13:40:43 +01:00
core kcov, usb: hide in_serving_softirq checks in __usb_hcd_giveback_urb 2021-01-07 14:17:29 +01:00
dwc2 usb: dwc2: Fix endpoint direction check in ep_from_windex 2021-02-05 10:28:38 +01:00
dwc3 usb: dwc3: fix clock issue during resume in OTG mode 2021-02-05 10:21:40 +01:00
early usb: early: ehci-dbgp: convert to readl_poll_timeout_atomic() 2020-09-25 16:29:09 +02:00
gadget USB: gadget: legacy: fix an error code in eth_bind() 2021-01-31 13:53:39 +01:00
host xhci: fix bounce buffer usage for non-sg list case 2021-02-03 13:14:45 +01:00
image USB: microtek: use set_host_byte() 2020-09-16 12:42:10 +02:00
isp1760 usb: isp1760-hcd: convert to readl_poll_timeout_atomic() 2020-09-25 16:30:05 +02:00
misc USB: yurex: fix control-URB timeout handling 2020-12-28 15:47:06 +01:00
mon
mtu3 usb: mtu3: fix memory corruption in mtu3_debugfs_regset() 2020-12-07 15:26:18 +01:00
musb usb: Fix fall-through warnings for Clang 2020-11-23 17:46:01 +01:00
phy Char / Misc driver updates for 5.11-rc1 2020-12-15 14:10:09 -08:00
renesas_usbhs usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop() 2021-02-01 14:09:46 +01:00
roles device connection: Remove struct device_connection 2020-09-07 11:14:09 +02:00
serial USB: serial: option: Adding support for Cinterion MV31 2021-01-28 08:44:05 +01:00
storage usb: uas: Add PNY USB Portable SSD to unusual_uas 2021-01-05 14:05:10 +01:00
typec usb: typec: Send uevent for num_altmodes update 2021-01-07 14:22:22 +01:00
usbip usb: usbip: vhci_hcd: protect shift size 2021-01-04 16:52:40 +01:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile usb: host: imx21-hcd: Remove the driver 2020-11-13 15:22:46 +01:00
usb-skeleton.c