* [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from_windex
@ 2021-01-27 8:50 Heiko Stuebner
2021-01-27 10:40 ` Heiko Stübner
0 siblings, 1 reply; 2+ messages in thread
From: Heiko Stuebner @ 2021-01-27 8:50 UTC (permalink / raw)
To: hminas, gregkh
Cc: christoph.muellner, paulz, yousaf.kaukab, balbi, linux-usb,
linux-kernel, heiko, Heiko Stuebner, stable
From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
the endpoint for the index provided in the wIndex request param.
In a test-case with a rndis gadget running and sending a malformed
packet to it like:
dev.ctrl_transfer(
0x82, # bmRequestType
0x00, # bRequest
0x0000, # wValue
0x0001, # wIndex
0x00 # wLength
)
it is possible to cause a crash:
[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
...
[ 218.313189] Call trace:
[ 218.330217] ep_from_windex+0x3c/0x54
[ 218.348565] usb_gadget_giveback_request+0x10/0x20
[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
This happens because ep_from_windex wants to compare the endpoint
direction even if index_to_ep() didn't return an endpoint due to
the direction not matching.
The fix is easy insofar that the actual direction check is already
happening when calling index_to_ep() which will return NULL if there
is no endpoint for the targeted direction, so the offending check
can go away completely.
Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Cc: stable@vger.kernel.org
---
changes in v2:
- remove unused struct dwc2_hsotg_ep *ep;
drivers/usb/dwc2/gadget.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0a0d11151cfb..ad4c94366dad 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1543,7 +1543,6 @@ static void dwc2_hsotg_complete_oursetup(struct usb_ep *ep,
static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
u32 windex)
{
- struct dwc2_hsotg_ep *ep;
int dir = (windex & USB_DIR_IN) ? 1 : 0;
int idx = windex & 0x7F;
@@ -1553,12 +1552,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
if (idx > hsotg->num_of_eps)
return NULL;
- ep = index_to_ep(hsotg, idx, dir);
-
- if (idx && ep->dir_in != dir)
- return NULL;
-
- return ep;
+ return index_to_ep(hsotg, idx, dir);
}
/**
--
2.29.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from_windex
2021-01-27 8:50 [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from_windex Heiko Stuebner
@ 2021-01-27 10:40 ` Heiko Stübner
0 siblings, 0 replies; 2+ messages in thread
From: Heiko Stübner @ 2021-01-27 10:40 UTC (permalink / raw)
To: hminas, gregkh
Cc: christoph.muellner, paulz, yousaf.kaukab, balbi, linux-usb,
linux-kernel, stable
Am Mittwoch, 27. Januar 2021, 09:50:34 CET schrieb Heiko Stuebner:
> From: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
>
> dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve
> the endpoint for the index provided in the wIndex request param.
>
> In a test-case with a rndis gadget running and sending a malformed
> packet to it like:
> dev.ctrl_transfer(
> 0x82, # bmRequestType
> 0x00, # bRequest
> 0x0000, # wValue
> 0x0001, # wIndex
> 0x00 # wLength
> )
> it is possible to cause a crash:
>
> [ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS
> [ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088
> ...
> [ 218.313189] Call trace:
> [ 218.330217] ep_from_windex+0x3c/0x54
> [ 218.348565] usb_gadget_giveback_request+0x10/0x20
> [ 218.368056] dwc2_hsotg_complete_request+0x144/0x184
>
> This happens because ep_from_windex wants to compare the endpoint
> direction even if index_to_ep() didn't return an endpoint due to
> the direction not matching.
>
> The fix is easy insofar that the actual direction check is already
> happening when calling index_to_ep() which will return NULL if there
> is no endpoint for the targeted direction, so the offending check
> can go away completely.
>
> Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
> Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
> Cc: stable@vger.kernel.org
superseeded by v3, which includes an appropriate Reported-by tag
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-01-27 10:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-27 8:50 [PATCH v2] usb: dwc2: Fix endpoint direction check in ep_from_windex Heiko Stuebner
2021-01-27 10:40 ` Heiko Stübner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).