diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-04-06 17:09:48 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-04-22 13:32:16 +0200 |
| commit | e3d42598f2995cdc07b7779874e7c5f8a1b773db (patch) | |
| tree | 7e5aad55c19221b2af5caad9a1d66eeeab333260 /tools/perf/scripts/python | |
| parent | 66f7471c4042e4eb300e30b5b9d87d1406862673 (diff) | |
| download | kernel-e3d42598f2995cdc07b7779874e7c5f8a1b773db.tar.gz | |
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
commit f880aac8a57ebd92abfa685d45424b2998ac1059 upstream.
The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint
number from the host-supplied wIndex without any sort of validation.
Fix this up by validating the number of endpoints actually match up with
the number the device has before attempting to dereference a pointer
based on this math.
This is just like what was done in commit ee0d382feb44 ("usb: gadget:
aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.
Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller")
Cc: stable <stable@kernel.org>
Assisted-by: gregkh_clanker_t1000
Link: https://patch.msgid.link/2026040647-sincerity-untidy-b104@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions