[PATCH] usb: gadget: fsl_udc: validate pipe index in ch9getstatus()

[PATCH] usb: gadget: fsl_udc: validate pipe index in ch9getstatus()

[Liu Chao]

ch9getstatus() uses get_pipe_by_windex() to compute a pipe index from
the host-supplied wIndex field and then passes it to get_ep_by_pipe()
to index the udc->eps[] array.  get_pipe_by_windex() can return up to
31, but udc->eps[] is allocated with udc->max_ep entries (typically
8-16 depending on the hardware).

The SET/CLEAR_FEATURE handler in the same function already checks
'pipe >= udc->max_ep' (line 1431) before indexing, but the GET_STATUS
path omits this check, allowing an out-of-bounds access.

Add the same pipe >= max_ep guard to the GET_STATUS endpoint path,
matching the existing check in the feature handler.

Fixes: b504882df105 ("USB: add Freescale high-speed USB SOC device controller driver")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/fsl_udc_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
index 20392409a..ed70cc650 100644
--- a/drivers/usb/gadget/udc/fsl_udc_core.c
+++ b/drivers/usb/gadget/udc/fsl_udc_core.c
@@ -1344,8 +1344,12 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value,
 	} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
 		/* Get endpoint status */
 		struct fsl_ep *target_ep;
+		int pipe = get_pipe_by_windex(index);
 
-		target_ep = get_ep_by_pipe(udc, get_pipe_by_windex(index));
+		if (pipe >= udc->max_ep)
+			goto stall;
+
+		target_ep = get_ep_by_pipe(udc, pipe);
 
 		/* stall if endpoint doesn't exist */
 		if (!target_ep->ep.desc)
-- 
2.50.1