mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 23:58:05 +00:00
USB: gadget: validate endpoint index for xilinx udc
commit 7f14c7227f
upstream.
Assure that host may not manipulate the index to point
past endpoint array.
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
9ab652d41d
commit
6b23eda989
1 changed files with 6 additions and 0 deletions
|
@ -1613,6 +1613,8 @@ static void xudc_getstatus(struct xusb_udc *udc)
|
||||||
break;
|
break;
|
||||||
case USB_RECIP_ENDPOINT:
|
case USB_RECIP_ENDPOINT:
|
||||||
epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
|
epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
|
||||||
|
if (epnum >= XUSB_MAX_ENDPOINTS)
|
||||||
|
goto stall;
|
||||||
target_ep = &udc->ep[epnum];
|
target_ep = &udc->ep[epnum];
|
||||||
epcfgreg = udc->read_fn(udc->addr + target_ep->offset);
|
epcfgreg = udc->read_fn(udc->addr + target_ep->offset);
|
||||||
halt = epcfgreg & XUSB_EP_CFG_STALL_MASK;
|
halt = epcfgreg & XUSB_EP_CFG_STALL_MASK;
|
||||||
|
@ -1680,6 +1682,10 @@ static void xudc_set_clear_feature(struct xusb_udc *udc)
|
||||||
case USB_RECIP_ENDPOINT:
|
case USB_RECIP_ENDPOINT:
|
||||||
if (!udc->setup.wValue) {
|
if (!udc->setup.wValue) {
|
||||||
endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
|
endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
|
||||||
|
if (endpoint >= XUSB_MAX_ENDPOINTS) {
|
||||||
|
xudc_ep0_stall(udc);
|
||||||
|
return;
|
||||||
|
}
|
||||||
target_ep = &udc->ep[endpoint];
|
target_ep = &udc->ep[endpoint];
|
||||||
outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK;
|
outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK;
|
||||||
outinbit = outinbit >> 7;
|
outinbit = outinbit >> 7;
|
||||||
|
|
Loading…
Reference in a new issue