]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 6 Apr 2026 15:09:48 +0000 (17:09 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 7 Apr 2026 11:48:30 +0000 (13:48 +0200)
commitf880aac8a57ebd92abfa685d45424b2998ac1059
tree4c5d066bc842ff22364d50f643cb9ddcfd0eeb46
parent274875f72f6c188cdc9d4424e02341472bc2b3c1
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers

The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint
number from the host-supplied wIndex without any sort of validation.
Fix this up by validating the number of endpoints actually match up with
the number the device has before attempting to dereference a pointer
based on this math.

This is just like what was done in commit ee0d382feb44 ("usb: gadget:
aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.

Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
Cc: stable <stable@kernel.org>
Assisted-by: gregkh_clanker_t1000
Link: https://patch.msgid.link/2026040647-sincerity-untidy-b104@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/udc/renesas_usb3.c