From: Greg Kroah-Hartman Date: Fri, 22 Sep 2023 16:24:32 +0000 (+0200) Subject: fix up usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch X-Git-Tag: v4.14.326~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a8e9316e24ce0c888fa0ec1af12d29703c89b8e1;p=thirdparty%2Fkernel%2Fstable-queue.git fix up usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch --- diff --git a/queue-4.14/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch b/queue-4.14/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch index 45f7b90b7ee..fca90ea31f4 100644 --- a/queue-4.14/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch +++ b/queue-4.14/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch @@ -1,4 +1,4 @@ -From 959bb80ec7ec44339b1801c05df51339eb5263ae Mon Sep 17 00:00:00 2001 +From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 28 Jun 2023 16:15:11 +0800 Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc @@ -16,22 +16,23 @@ Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index a3e72d690eef9..962e3ea4dc147 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -1954,6 +1954,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, +@@ -1954,9 +1954,13 @@ static void ch9getstatus(struct qe_udc * } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { /* Get endpoint status */ int pipe = index & USB_ENDPOINT_NUMBER_MASK; -+ if (pipe >= USB_MAX_ENDPOINTS) -+ goto stall; - struct qe_ep *target_ep = &udc->eps[pipe]; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; u16 usep; --- -2.40.1 - ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall; diff --git a/queue-4.19/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch b/queue-4.19/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch index 2ded5f05fe0..89f9d8f520a 100644 --- a/queue-4.19/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch +++ b/queue-4.19/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch @@ -1,4 +1,4 @@ -From d034cff20526be8b91ae6e3f588bfd0e5809df1b Mon Sep 17 00:00:00 2001 +From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 28 Jun 2023 16:15:11 +0800 Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc @@ -16,22 +16,23 @@ Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index 2707be6282988..63109c6e55068 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -1950,6 +1950,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, +@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc * } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { /* Get endpoint status */ int pipe = index & USB_ENDPOINT_NUMBER_MASK; -+ if (pipe >= USB_MAX_ENDPOINTS) -+ goto stall; - struct qe_ep *target_ep = &udc->eps[pipe]; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; u16 usep; --- -2.40.1 - ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall; diff --git a/queue-5.10/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch b/queue-5.10/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch index 413f22cf2d7..89f9d8f520a 100644 --- a/queue-5.10/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch +++ b/queue-5.10/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch @@ -1,4 +1,4 @@ -From 978f0e873a8060ada7b2e1154a576e3e6c4962ed Mon Sep 17 00:00:00 2001 +From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 28 Jun 2023 16:15:11 +0800 Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc @@ -16,22 +16,23 @@ Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index fa66449b39075..f3388c720e0fa 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -1950,6 +1950,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, +@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc * } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { /* Get endpoint status */ int pipe = index & USB_ENDPOINT_NUMBER_MASK; -+ if (pipe >= USB_MAX_ENDPOINTS) -+ goto stall; - struct qe_ep *target_ep = &udc->eps[pipe]; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; u16 usep; --- -2.40.1 - ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall; diff --git a/queue-5.15/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch b/queue-5.15/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch index f669b611fe3..4d718facc89 100644 --- a/queue-5.15/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch +++ b/queue-5.15/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch @@ -1,4 +1,4 @@ -From bbcaf4e578c3501723c298e2aeac36c5f68059f3 Mon Sep 17 00:00:00 2001 +From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 28 Jun 2023 16:15:11 +0800 Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc @@ -16,22 +16,23 @@ Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index 15db7a3868fe4..aff4050f96dd6 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -1956,6 +1956,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, +@@ -1956,9 +1956,13 @@ static void ch9getstatus(struct qe_udc * } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { /* Get endpoint status */ int pipe = index & USB_ENDPOINT_NUMBER_MASK; -+ if (pipe >= USB_MAX_ENDPOINTS) -+ goto stall; - struct qe_ep *target_ep = &udc->eps[pipe]; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; u16 usep; --- -2.40.1 - ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall; diff --git a/queue-5.4/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch b/queue-5.4/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch index 80e3d7817b7..89f9d8f520a 100644 --- a/queue-5.4/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch +++ b/queue-5.4/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch @@ -1,4 +1,4 @@ -From 18786884ee700d9277c71db2d51b8705164164bb Mon Sep 17 00:00:00 2001 +From ea14c429f234ba581ae6a75fa1ef730b49940fef Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 28 Jun 2023 16:15:11 +0800 Subject: usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc @@ -16,22 +16,23 @@ Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index 2707be6282988..63109c6e55068 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -1950,6 +1950,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, +@@ -1950,9 +1950,13 @@ static void ch9getstatus(struct qe_udc * } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { /* Get endpoint status */ int pipe = index & USB_ENDPOINT_NUMBER_MASK; -+ if (pipe >= USB_MAX_ENDPOINTS) -+ goto stall; - struct qe_ep *target_ep = &udc->eps[pipe]; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; u16 usep; --- -2.40.1 - ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall; diff --git a/queue-6.1/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch b/queue-6.1/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch index 7f110bf953f..5db5d5148e6 100644 --- a/queue-6.1/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch +++ b/queue-6.1/usb-gadget-fsl_qe_udc-validate-endpoint-index-for-ch.patch @@ -16,22 +16,23 @@ Link: https://lore.kernel.org/r/20230628081511.186850-1-make_ruc2021@163.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/usb/gadget/udc/fsl_qe_udc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) -diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c -index 3b1cc8fa30c83..f4e5cbd193b7b 100644 --- a/drivers/usb/gadget/udc/fsl_qe_udc.c +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c -@@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, +@@ -1959,9 +1959,13 @@ static void ch9getstatus(struct qe_udc * } else if ((request_type & USB_RECIP_MASK) == USB_RECIP_ENDPOINT) { /* Get endpoint status */ int pipe = index & USB_ENDPOINT_NUMBER_MASK; -+ if (pipe >= USB_MAX_ENDPOINTS) -+ goto stall; - struct qe_ep *target_ep = &udc->eps[pipe]; +- struct qe_ep *target_ep = &udc->eps[pipe]; ++ struct qe_ep *target_ep; u16 usep; --- -2.40.1 - ++ if (pipe >= USB_MAX_ENDPOINTS) ++ goto stall; ++ target_ep = &udc->eps[pipe]; ++ + /* stall if endpoint doesn't exist */ + if (!target_ep->ep.desc) + goto stall;