From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAB86C433E0 for ; Wed, 27 Jan 2021 11:21:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6FA9420754 for ; Wed, 27 Jan 2021 11:21:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236440AbhA0LUt (ORCPT ); Wed, 27 Jan 2021 06:20:49 -0500 Received: from gloria.sntech.de ([185.11.138.130]:42148 "EHLO gloria.sntech.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235466AbhA0Klg (ORCPT ); Wed, 27 Jan 2021 05:41:36 -0500 Received: from ip5f5aa64a.dynamic.kabel-deutschland.de ([95.90.166.74] helo=diego.localnet) by gloria.sntech.de with esmtpsa (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1l4iFm-0000lT-8T; Wed, 27 Jan 2021 11:40:50 +0100 From: Heiko =?ISO-8859-1?Q?St=FCbner?= To: hminas@synopsys.com, gregkh@linuxfoundation.org Cc: christoph.muellner@theobroma-systems.com, paulz@synopsys.com, yousaf.kaukab@intel.com, balbi@ti.com, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] usb: dwc2: Fix endpoint direction check in ep_from_windex Date: Wed, 27 Jan 2021 11:40:48 +0100 Message-ID: <8309688.OUTRe80PYV@diego> In-Reply-To: <20210125191324.1981199-1-heiko@sntech.de> References: <20210125191324.1981199-1-heiko@sntech.de> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Am Montag, 25. Januar 2021, 20:13:24 CET schrieb Heiko Stuebner: > From: Heiko Stuebner > > dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve > the endpoint for the index provided in the wIndex request param. > > In a test-case with a rndis gadget running and sending a malformed > packet to it like: > dev.ctrl_transfer( > 0x82, # bmRequestType > 0x00, # bRequest > 0x0000, # wValue > 0x0001, # wIndex > 0x00 # wLength > ) > it is possible to cause a crash: > > [ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS > [ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088 > ... > [ 218.313189] Call trace: > [ 218.330217] ep_from_windex+0x3c/0x54 > [ 218.348565] usb_gadget_giveback_request+0x10/0x20 > [ 218.368056] dwc2_hsotg_complete_request+0x144/0x184 > > This happens because ep_from_windex wants to compare the endpoint > direction even if index_to_ep() didn't return an endpoint due to > the direction not matching. > > The fix is easy insofar that the actual direction check is already > happening when calling index_to_ep() which will return NULL if there > is no endpoint for the targeted direction, so the offending check > can go away completely. > > Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support") > Signed-off-by: Heiko Stuebner > Cc: stable@vger.kernel.org superseeded by v3, which includes an appropriate Reported-by tag and removes an now unused variable (in v2).