40 lines
1.4 KiB
Diff
40 lines
1.4 KiB
Diff
|
From d43f2a9725a1211a0db657b9911a54d58ba26b36 Mon Sep 17 00:00:00 2001
|
||
|
|
From: tangbinzy <tangbin_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Fri, 8 Mar 2024 03:10:14 +0000
|
||
|
|
Subject: [PATCH] usb/hcd-xhci: check slotid in xhci_wakeup_endpoint()
|
||
|
|
mainline inclusion commit 84218892f05515d20347fde4506e1944eb11cb25 category:
|
||
|
|
bugfix
|
||
|
|
|
||
|
|
---------------------------------------------------------------
|
||
|
|
|
||
|
|
This prevents an OOB read (followed by an assertion failure in
|
||
|
|
xhci_kick_ep) when slotid > xhci->numslots.
|
||
|
|
|
||
|
|
Reported-by: Soul Chen <soulchen8650@gmail.com>
|
||
|
|
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
|
||
|
|
Message-Id: <20220705174734.2348829-1-mcascell@redhat.com>
|
||
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||
|
|
|
||
|
|
Signed-off-by: tangbinzy <tangbin_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/usb/hcd-xhci.c | 3 ++-
|
||
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
|
||
|
|
index 40300e1bcd..29636795be 100644
|
||
|
|
--- a/hw/usb/hcd-xhci.c
|
||
|
|
+++ b/hw/usb/hcd-xhci.c
|
||
|
|
@@ -3288,7 +3288,8 @@ static void xhci_wakeup_endpoint(USBBus *bus, USBEndpoint *ep,
|
||
|
|
|
||
|
|
DPRINTF("%s\n", __func__);
|
||
|
|
slotid = ep->dev->addr;
|
||
|
|
- if (slotid == 0 || !xhci->slots[slotid-1].enabled) {
|
||
|
|
+ if (slotid == 0 || slotid > xhci->numslots ||
|
||
|
|
+ !xhci->slots[slotid - 1].enabled) {
|
||
|
|
DPRINTF("%s: oops, no slot for dev %d\n", __func__, ep->dev->addr);
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|