-From 959bb80ec7ec44339b1801c05df51339eb5263ae Mon Sep 17 00:00:00 2001
+From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 28 Jun 2023 16:15:11 +0800
Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index a3e72d690eef9..962e3ea4dc147 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1954,6 +1954,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+@@ -1954,9 +1954,13 @@ static void ch9getstatus(struct qe_udc *
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-+ if (pipe >= USB_MAX_ENDPOINTS)
-+ goto stall;
- struct qe_ep *target_ep = &udc->eps[pipe];
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
u16 usep;
---
-2.40.1
-
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;
-From d034cff20526be8b91ae6e3f588bfd0e5809df1b Mon Sep 17 00:00:00 2001
+From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 28 Jun 2023 16:15:11 +0800
Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index 2707be6282988..63109c6e55068 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1950,6 +1950,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc *
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-+ if (pipe >= USB_MAX_ENDPOINTS)
-+ goto stall;
- struct qe_ep *target_ep = &udc->eps[pipe];
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
u16 usep;
---
-2.40.1
-
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;
-From 978f0e873a8060ada7b2e1154a576e3e6c4962ed Mon Sep 17 00:00:00 2001
+From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 28 Jun 2023 16:15:11 +0800
Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index fa66449b39075..f3388c720e0fa 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1950,6 +1950,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc *
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-+ if (pipe >= USB_MAX_ENDPOINTS)
-+ goto stall;
- struct qe_ep *target_ep = &udc->eps[pipe];
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
u16 usep;
---
-2.40.1
-
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;
-From bbcaf4e578c3501723c298e2aeac36c5f68059f3 Mon Sep 17 00:00:00 2001
+From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 28 Jun 2023 16:15:11 +0800
Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index 15db7a3868fe4..aff4050f96dd6 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1956,6 +1956,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+@@ -1956,9 +1956,13 @@ static void ch9getstatus(struct qe_udc *
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-+ if (pipe >= USB_MAX_ENDPOINTS)
-+ goto stall;
- struct qe_ep *target_ep = &udc->eps[pipe];
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
u16 usep;
---
-2.40.1
-
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;
-From 18786884ee700d9277c71db2d51b8705164164bb Mon Sep 17 00:00:00 2001
+From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 28 Jun 2023 16:15:11 +0800
Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index 2707be6282988..63109c6e55068 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1950,6 +1950,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc *
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-+ if (pipe >= USB_MAX_ENDPOINTS)
-+ goto stall;
- struct qe_ep *target_ep = &udc->eps[pipe];
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
u16 usep;
---
-2.40.1
-
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index 3b1cc8fa30c83..f4e5cbd193b7b 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
+@@ -1959,9 +1959,13 @@ static void ch9getstatus(struct qe_udc *
} else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) {
/* Get endpoint status */
int pipe = index & USB_ENDPOINT_NUMBER_MASK;
-+ if (pipe >= USB_MAX_ENDPOINTS)
-+ goto stall;
- struct qe_ep *target_ep = &udc->eps[pipe];
+- struct qe_ep *target_ep = &udc->eps[pipe];
++ struct qe_ep *target_ep;
u16 usep;
---
-2.40.1
-
++ if (pipe >= USB_MAX_ENDPOINTS)
++ goto stall;
++ target_ep = &udc->eps[pipe];
++
+ /* stall if endpoint doesn't exist */
+ if (!target_ep->ep.desc)
+ goto stall;