lkml.org 
[lkml]   [2021]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from_windex
Date
Am Mittwoch, 27. Januar 2021, 09:50:34 CET schrieb Heiko Stuebner:
> From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
>
> dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
> the endpoint for the index provided in the wIndex request param.
>
> In a test-case with a rndis gadget running and sending a malformed
> packet to it like:
> dev.ctrl_transfer(
> 0x82, # bmRequestType
> 0x00, # bRequest
> 0x0000, # wValue
> 0x0001, # wIndex
> 0x00 # wLength
> )
> it is possible to cause a crash:
>
> [ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
> [ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
> ...
> [ 218.313189] Call trace:
> [ 218.330217] ep_from_windex+0x3c/0x54
> [ 218.348565] usb_gadget_giveback_request+0x10/0x20
> [ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
>
> This happens because ep_from_windex wants to compare the endpoint
> direction even if index_to_ep() didn't return an endpoint due to
> the direction not matching.
>
> The fix is easy insofar that the actual direction check is already
> happening when calling index_to_ep() which will return NULL if there
> is no endpoint for the targeted direction, so the offending check
> can go away completely.
>
> Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
> Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
> Cc: stable@vger.kernel.org

superseeded by v3, which includes an appropriate Reported-by tag


\
 
 \ /
  Last update: 2021-01-27 11:47    [W:0.025 / U:0.472 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site