| Message ID | 20240622142308.1929531-1-make24@iscas.ac.cn |
|---|---|
| State | New |
| Headers | show |
| Series | usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc | expand |
Hi Ma, kernel test robot noticed the following build errors: [auto build test ERROR on usb/usb-testing] [also build test ERROR on usb/usb-next usb/usb-linus linus/master v6.10-rc5 next-20240625] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/usb-gadget-r8a66597-udc-validate-endpoint-index-for-r8a66597-udc/20240626-003228 base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing patch link: https://lore.kernel.org/r/20240622142308.1929531-1-make24%40iscas.ac.cn patch subject: [PATCH] usb: gadget: r8a66597-udc: validate endpoint index for r8a66597 udc config: i386-buildonly-randconfig-004-20240626 (https://download.01.org/0day-ci/archive/20240626/202406261220.OagNp3Mb-lkp@intel.com/config) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240626/202406261220.OagNp3Mb-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406261220.OagNp3Mb-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/usb/gadget/udc/r8a66597-udc.c: In function 'get_status': >> drivers/usb/gadget/udc/r8a66597-udc.c:1178:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'? 1178 | if (pipe >= USB_MAX_ENDPOINTS) | ^~~~~~~~~~~~~~~~~ | USB_DT_ENDPOINT drivers/usb/gadget/udc/r8a66597-udc.c:1178:29: note: each undeclared identifier is reported only once for each function it appears in drivers/usb/gadget/udc/r8a66597-udc.c: In function 'clear_feature': drivers/usb/gadget/udc/r8a66597-udc.c:1217:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'? 1217 | if (pipe >= USB_MAX_ENDPOINTS) | ^~~~~~~~~~~~~~~~~ | USB_DT_ENDPOINT drivers/usb/gadget/udc/r8a66597-udc.c: In function 'set_feature': drivers/usb/gadget/udc/r8a66597-udc.c:1280:29: error: 'USB_MAX_ENDPOINTS' undeclared (first use in this function); did you mean 'USB_DT_ENDPOINT'? 1280 | if (pipe >= USB_MAX_ENDPOINTS) | ^~~~~~~~~~~~~~~~~ | USB_DT_ENDPOINT vim +1178 drivers/usb/gadget/udc/r8a66597-udc.c 1158 1159 static void get_status(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl) 1160 __releases(r8a66597->lock) 1161 __acquires(r8a66597->lock) 1162 { 1163 struct r8a66597_ep *ep; 1164 u16 pid; 1165 u16 status = 0; 1166 u16 w_index = le16_to_cpu(ctrl->wIndex); 1167 1168 switch (ctrl->bRequestType & USB_RECIP_MASK) { 1169 case USB_RECIP_DEVICE: 1170 status = r8a66597->device_status; 1171 break; 1172 case USB_RECIP_INTERFACE: 1173 status = 0; 1174 break; 1175 case USB_RECIP_ENDPOINT: 1176 int pipe = w_index & USB_ENDPOINT_NUMBER_MASK; 1177 > 1178 if (pipe >= USB_MAX_ENDPOINTS) 1179 break; 1180 ep = r8a66597->epaddr2ep[pipe]; 1181 pid = control_reg_get_pid(r8a66597, ep->pipenum); 1182 if (pid == PID_STALL) 1183 status = 1 << USB_ENDPOINT_HALT; 1184 else 1185 status = 0; 1186 break; 1187 default: 1188 pipe_stall(r8a66597, 0); 1189 return; /* exit */ 1190 } 1191 1192 r8a66597->ep0_data = cpu_to_le16(status); 1193 r8a66597->ep0_req->buf = &r8a66597->ep0_data; 1194 r8a66597->ep0_req->length = 2; 1195 /* AV: what happens if we get called again before that gets through? */ 1196 spin_unlock(&r8a66597->lock); 1197 r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_ATOMIC); 1198 spin_lock(&r8a66597->lock); 1199 } 1200
diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c index db4a10a979f9..93fc4201c0ae 100644 --- a/drivers/usb/gadget/udc/r8a66597-udc.c +++ b/drivers/usb/gadget/udc/r8a66597-udc.c @@ -1173,7 +1173,11 @@ __acquires(r8a66597->lock) status = 0; break; case USB_RECIP_ENDPOINT: - ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK]; + int pipe = w_index & USB_ENDPOINT_NUMBER_MASK; + + if (pipe >= USB_MAX_ENDPOINTS) + break; + ep = r8a66597->epaddr2ep[pipe]; pid = control_reg_get_pid(r8a66597, ep->pipenum); if (pid == PID_STALL) status = 1 << USB_ENDPOINT_HALT; @@ -1208,8 +1212,11 @@ static void clear_feature(struct r8a66597 *r8a66597, struct r8a66597_ep *ep; struct r8a66597_request *req; u16 w_index = le16_to_cpu(ctrl->wIndex); + int pipe = w_index & USB_ENDPOINT_NUMBER_MASK; - ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK]; + if (pipe >= USB_MAX_ENDPOINTS) + break; + ep = r8a66597->epaddr2ep[pipe]; if (!ep->wedge) { pipe_stop(r8a66597, ep->pipenum); control_reg_sqclr(r8a66597, ep->pipenum); @@ -1268,8 +1275,11 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl) case USB_RECIP_ENDPOINT: { struct r8a66597_ep *ep; u16 w_index = le16_to_cpu(ctrl->wIndex); + int pipe = w_index & USB_ENDPOINT_NUMBER_MASK; - ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK]; + if (pipe >= USB_MAX_ENDPOINTS) + break; + ep = r8a66597->epaddr2ep[pipe]; pipe_stall(r8a66597, ep->pipenum); control_end(r8a66597, 1);
We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Signed-off-by: Ma Ke <make24@iscas.ac.cn> --- drivers/usb/gadget/udc/r8a66597-udc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)