[PATCH] usb: gadget: udc: max3420: validate endpoint index before array access

[Pavitra Jha]

USB SETUP packets originate from an external USB host and must be
treated as untrusted input.

The endpoint index is derived from wIndex masked with
USB_ENDPOINT_NUMBER_MASK, producing values in the range 0-15. However,
udc->ep[] contains only MAX3420_MAX_EPS (4) entries.

Using this unvalidated value as an array index allows out-of-bounds
read and write access to memory beyond the ep[] array when wIndex >= 4.

Add bounds checks in max3420_getstatus() and
max3420_set_clear_feature() before using the derived index.

Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Pavitra Jha <jhapavitra98@xxxxxxxxx>
Signed-off-by: Pavitra Jha <jhapavitra98@xxxxxxxxx>
---
 drivers/usb/gadget/udc/max3420_udc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/max3420_udc.c b/drivers/usb/gadget/udc/max3420_udc.c
index 11fd61cba..070893723 100644
--- a/drivers/usb/gadget/udc/max3420_udc.c
+++ b/drivers/usb/gadget/udc/max3420_udc.c
@@ -548,7 +548,10 @@ static void max3420_getstatus(struct max3420_udc *udc)
 			goto stall;
 		break;
 	case USB_RECIP_ENDPOINT:
-		ep = &udc->ep[udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK];
+		id = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
+		if (id >= MAX3420_MAX_EPS)
+			goto stall;
+		ep = &udc->ep[id];
 		if (udc->setup.wIndex & USB_DIR_IN) {
 			if (!ep->ep_usb.caps.dir_in)
 				goto stall;
@@ -596,6 +599,8 @@ static void max3420_set_clear_feature(struct max3420_udc *udc)
 			break;
 
 		id = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
+		if (id >= MAX3420_MAX_EPS)
+			goto stall;
 		ep = &udc->ep[id];
 
 		spin_lock_irqsave(&ep->lock, flags);
-- 
2.53.0