Skip to content

Commit 75e5b48

Browse files
szymonhgregkh
authored andcommitted
USB: gadget: validate interface OS descriptor requests
Stall the control endpoint in case provided index exceeds array size of MAX_CONFIG_INTERFACES or when the retrieved function pointer is null. Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent c853685 commit 75e5b48

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

Diff for: drivers/usb/gadget/composite.c

+3
Original file line numberDiff line numberDiff line change
@@ -1988,6 +1988,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
19881988
if (w_index != 0x5 || (w_value >> 8))
19891989
break;
19901990
interface = w_value & 0xFF;
1991+
if (interface >= MAX_CONFIG_INTERFACES ||
1992+
!os_desc_cfg->interface[interface])
1993+
break;
19911994
buf[6] = w_index;
19921995
count = count_ext_prop(os_desc_cfg,
19931996
interface);

0 commit comments

Comments
 (0)