From 7f14c7227f342d9932f9b918893c8814f86d2a0d Mon Sep 17 00:00:00 2001

From: Szymon Heidrich <szymon.heidrich@gmail.com>

Date: Mon, 21 Feb 2022 13:24:56 +0100

Subject: [PATCH] USB: gadget: validate endpoint index for xilinx udc

Git-commit: 7f14c7227f342d9932f9b918893c8814f86d2a0d

Patch-mainline: v5.17-rc6

References: CVE-2022-27223 bsc#1197245 git-fixes

Assure that host may not manipulate the index to point

past endpoint array.

Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>

Cc: stable <stable@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/usb/gadget/udc/udc-xilinx.c | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c

index 6ce886fb7bfe..2907fad04e2c 100644

--- a/drivers/usb/gadget/udc/udc-xilinx.c

+++ b/drivers/usb/gadget/udc/udc-xilinx.c

@@ -1615,6 +1615,8 @@ static void xudc_getstatus(struct xusb_udc *udc)

 		break;

 	case USB_RECIP_ENDPOINT:

 		epnum = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;

+		if (epnum >= XUSB_MAX_ENDPOINTS)

+			goto stall;

 		target_ep = &udc->ep[epnum];

 		epcfgreg = udc->read_fn(udc->addr + target_ep->offset);

 		halt = epcfgreg & XUSB_EP_CFG_STALL_MASK;

@@ -1682,6 +1684,10 @@ static void xudc_set_clear_feature(struct xusb_udc *udc)

 	case USB_RECIP_ENDPOINT:

 		if (!udc->setup.wValue) {

 			endpoint = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;

+			if (endpoint >= XUSB_MAX_ENDPOINTS) {

+				xudc_ep0_stall(udc);

+				return;

+			}

 			target_ep = &udc->ep[endpoint];

 			outinbit = udc->setup.wIndex & USB_ENDPOINT_DIR_MASK;

 			outinbit = outinbit >> 7;

-- 

2.31.1