Re: [PATCH] USB: gadget: max3420: validate endpoint index in set_clear_feature

[Greg KH]

On Mon, Jan 05, 2026 at 04:14:02PM +0800, Kery Qi wrote:
> Assure that the host may not manipulate the index to point past the
> endpoint array.
> 
> In max3420_set_clear_feature(), the driver derives the endpoint
> index from the wIndex field of the setup packet. However, there is
> no check to ensure this index is within the valid bounds of the
> udc->ep[] array.
> 
> A malicious host could send a USB_REQ_SET_FEATURE or
> USB_REQ_CLEAR_FEATURE request with a large endpoint index, leading
> to an out-of-bounds memory access when accessing udc->ep[id].
> 
> This patch adds a validation check against MAX3420_MAX_EPS. If the
> endpoint index is invalid, we simply break the switch statement
> to invoke the existing error handling path.
> 
> Signed-off-by: Kery Qi <qikeyu2017@xxxxxxxxx>
> ---
>  drivers/usb/gadget/udc/max3420_udc.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/gadget/udc/max3420_udc.c b/drivers/usb/gadget/udc/max3420_udc.c
> index ac11ddf3fcbc..f4f549d88d6d 100644
> --- a/drivers/usb/gadget/udc/max3420_udc.c
> +++ b/drivers/usb/gadget/udc/max3420_udc.c
> @@ -600,6 +600,8 @@ static void max3420_set_clear_feature(struct max3420_udc *udc)
>  			break;
>  
>  		id = udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK;
> +		if (id >= MAX3420_MAX_EPS)
> +			break;
>  		ep = &udc->ep[id];
>  
>  		spin_lock_irqsave(&ep->lock, flags);
> -- 
> 2.34.1
> 

Same problems here as your other patch :(