Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Leo Li <leoyang.li@nxp.com>
To:     Ma Ke <make_ruc2021@163.com>
CC:     "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "linuxppc-dev@lists.ozlabs.org" <linuxppc-dev@lists.ozlabs.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH] usb: gadget: fsl_qe_udc: validate endpoint index for ch9
 udc
Thread-Topic: [PATCH] usb: gadget: fsl_qe_udc: validate endpoint index for ch9
 udc
Thread-Index: AQHZqZi9K7bLkqeFik2hEi3PRtnNM6+gcHbg
Date:   Wed, 28 Jun 2023 17:04:00 +0000
Message-ID: <AM0PR04MB62893E77D085030A6E2C37B28F24A@AM0PR04MB6289.eurprd04.prod.outlook.com>
References: <20230628081511.186850-1-make_ruc2021@163.com>
In-Reply-To: <20230628081511.186850-1-make_ruc2021@163.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?4eHRxZb7/38lF7pPt2Hp3PGP48oSFRAlJGRYojkX+NRzbFZuTymEYMsxBWro?=
 =?us-ascii?Q?yFG3UBO3eqsrR6y+ENlm+mGjFtpfEdFQvLgA6J+Ua01hMENwSBwSTndNESnW?=
 =?us-ascii?Q?4HeTAxgvR6G9igQ/M1GJBIlNDysYvqL7V5HN0Jmlvwppo27eyj4TLlXsKZbG?=
 =?us-ascii?Q?RW4lQ0PJjo6LrK5QgqFr8UIuIi+u1SOum15TcbBBXosL1UxmspZQTugoTOq5?=
 =?us-ascii?Q?t4RD4zBfzp6xAyU1SWCzJvD10uyqMt7DUjLNmVKhApS1FiNwRU1SBEDGgssR?=
 =?us-ascii?Q?cDniFMaIS6KCo45FmtXR/owrkUnNjCHWbdnQsL+M6JacgNcH5dk+8QJWUWSE?=
 =?us-ascii?Q?08sHvysw620lz3Z+xdMutZtoFV7FGQHFdi2TJkz//D/EBB7Qd9grkGJWkRS6?=
 =?us-ascii?Q?JphJjFJs29sMyj9TyjclVS1mpuSAVguZXkDCKJiYq62l22gKDhyr7v2cmxyH?=
 =?us-ascii?Q?e6ys6q7OKdKqspdXzGwDQeA+hxD7/pJrD7W/NZZRC9z/yQKqGuSc4ham7eYz?=
 =?us-ascii?Q?5j7RQa6nYorPzsxTDg2FtcP382OU7Jn+X9yFkABVgSnyaJvZbSQa0dzBDzlv?=
 =?us-ascii?Q?eQGJcTlWyEQVfXrVYs0i7czicEmW0mS1i0J1tqrJhGrxwvP34Y/k9xh6uJNo?=
 =?us-ascii?Q?DJvuJYhbet9/dS5wVXCU/fQwfT/+3M7fsCTV2+BtTraWYuguSNd83fEVHW9M?=
 =?us-ascii?Q?ymHNLkbXzRBWhUTgP2kPoycslfOyESu3IXrBWlMHLCerBpf2BmOXUD6uv8uS?=
 =?us-ascii?Q?vvqpdog+CT+z0A9xz6QLaLGGrcif+LVV2BbKQrxS0I+sEeLw7VGErA8ETZHF?=
 =?us-ascii?Q?vkTQVjrioAODYGm7BKCyH/+uBUO+qBvFid3iB5ho7dTbsiV59qDYIZwDm0vR?=
 =?us-ascii?Q?Lpp2yEUY3MIlp7BbVFMxbnLgWALZ0Hq0FYFZRDGJgyKguIzIM4hCI+pPwy5n?=
 =?us-ascii?Q?3Jd8FWmJjaG6KypS8yFTj7HakX8E7nQJTt6kqb09W/66jhFRI80muTKiMB/n?=
 =?us-ascii?Q?CjNKwZr0qEdy5K4vzlJvMbqwfsmbJ9T5JJVZ8A6CwI+wCHm+0EmYsTPmdJ/B?=
 =?us-ascii?Q?W6sOERT3NDJJ3z3AuNvC6TLNtnHxxju9Rj5xQ7VBzq3a7myWkCAuMWleZ8UX?=
 =?us-ascii?Q?FXB0bVZDq/2+BnNevpwZwjAA00nAw2K+Jag5VkKwr49FM50QYETKmeLLbVxB?=
 =?us-ascii?Q?t+HnoBvmy/IMbBPaN3qts00hcBmDzzntZBTHP5E8eBsi26xXjGYbHw6SgWHq?=
 =?us-ascii?Q?w9Py5KChRjpxt+n01K/89AMJuSjkCI4LjS+K2Y3b/hwqUO+zjBbxZNaNMNcw?=
 =?us-ascii?Q?wx/2HEhkGmqej8bwch4QGnHvTAMXJe6/kgfh3/Xvt8l4CwlcwDSn/b574xQp?=
 =?us-ascii?Q?9f+CtOgoRC1kYlVlwJVtdXP0EZsKN+MtFYowfBV07dI7KMncAwVtHTouApU0?=
 =?us-ascii?Q?rrzTSmc6NVySJ3Y1nFJfugB060K5XLAAEDTh/zVPgj49me6JPavmsqLZLdmw?=
 =?us-ascii?Q?vufaf9wgMyMG1YiOR4fHJHdC6ycTouVIDu6BK2u0XGOUrDmW7cyBz5OdmirH?=
 =?us-ascii?Q?tDMG6SJqifCcuKvxc7c=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB6289.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3c1f9392-3ca9-4c33-fe15-08db77f9ab14
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jun 2023 17:04:00.3449
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 6ehTqAPjmEsBERMltFzR/3FdPXQuLkT32A4McmUomaX0tVD7Ehnw7NHd8v2C+tNHIri7UUFeNSeJPTg9zW/oCA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR04MB7295
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> -----Original Message-----
> From: Ma Ke <make_ruc2021@163.com>
> Sent: Wednesday, June 28, 2023 3:15 AM
> To: Leo Li <leoyang.li@nxp.com>
> Cc: gregkh@linuxfoundation.org; linux-usb@vger.kernel.org; linuxppc-
> dev@lists.ozlabs.org; linux-kernel@vger.kernel.org; Ma Ke
> <make_ruc2021@163.com>
> Subject: [PATCH] usb: gadget: fsl_qe_udc: validate endpoint index for ch9
> udc
>=20
> We should verify the bound of the array to assure that host may not
> manipulate the index to point past endpoint array.
>=20
> Signed-off-by: Ma Ke <make_ruc2021@163.com>
> ---
>  drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
>  1 file changed, 2 insertions(+)
>=20
> diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c
> b/drivers/usb/gadget/udc/fsl_qe_udc.c
> index 3b1cc8fa30c8..f4e5cbd193b7 100644
> --- a/drivers/usb/gadget/udc/fsl_qe_udc.c
> +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
> @@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8
> request_type, u16 value,
>  	} else if ((request_type & USB_RECIP_MASK) =3D=3D
> USB_RECIP_ENDPOINT) {
>  		/* Get endpoint status */
>  		int pipe =3D index & USB_ENDPOINT_NUMBER_MASK;
> +		if (pipe >=3D USB_MAX_ENDPOINTS)
> +			goto stall;

Thanks.  This seems to be the right thing to do.  But normally we don't mix=
 declarations with code within a code block.  Could we re-arrange the code =
a little bit so declarations stay on top?

>  		struct qe_ep *target_ep =3D &udc->eps[pipe];
>  		u16 usep;
>=20
> --
> 2.37.2