diff options
| author | Ma Ke <[email protected]> | 2024-06-25 10:23:06 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2024-06-27 16:07:30 +0200 |
| commit | ee0d382feb44ec0f445e2ad63786cd7f3f6a8199 (patch) | |
| tree | d78d0324d88a00741df1b8fcc6578ff3412d9f1c | |
| parent | 859976e8e744dc5e23903baca2724eebe85d9d27 (diff) | |
usb: gadget: aspeed_udc: validate endpoint index for ast udc
We should verify the bound of the array to assure that host
may not manipulate the index to point past endpoint array.
Found by static analysis.
Signed-off-by: Ma Ke <[email protected]>
Reviewed-by: Andrew Jeffery <[email protected]>
Acked-by: Andrew Jeffery <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
| -rw-r--r-- | drivers/usb/gadget/udc/aspeed_udc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c index 3916c8e2ba01..d972ef4644bc 100644 --- a/drivers/usb/gadget/udc/aspeed_udc.c +++ b/drivers/usb/gadget/udc/aspeed_udc.c @@ -1009,6 +1009,8 @@ static void ast_udc_getstatus(struct ast_udc_dev *udc) break; case USB_RECIP_ENDPOINT: epnum = crq.wIndex & USB_ENDPOINT_NUMBER_MASK; + if (epnum >= AST_UDC_NUM_ENDPOINTS) + goto stall; status = udc->ep[epnum].stopped; break; default: |