Re: [PATCH] usb: fotg210: validate endpoint index in ep0 handlers

[Linus Walleij]

On Sun, Sep 13, 2026 at 2:05 PM Liu Chao <liuc63@xxxxxxxxxxxx> wrote:

> fotg210_set_feature(), fotg210_clear_feature() and fotg210_get_status()
> use wIndex from the USB setup packet to index the fotg210->ep[] array
> without verifying that the endpoint number falls below
> FOTG210_MAX_NUM_EP (5).  USB_ENDPOINT_NUMBER_MASK is 0x0f, so a
> malicious host can issue a setup packet with wIndex 5..15, resulting in
> an out-of-bounds array read.  The resulting wild pointer is then
> dereferenced in fotg210_set_epnstall() or fotg210_is_epnstall(), which
> compute an MMIO register offset from ep->epnum and perform iowrite32
> through it.
>
> fotg210_clear_feature() is especially problematic: the out-of-bounds
> access occurs at function entry (source-level) regardless of which
> USB_RECIP_* case is taken, because the ep pointer is computed before the
> switch statement.
>
> Add upper-bound checks on the endpoint number derived from wIndex in
> all three functions.  Invalid endpoint numbers in clear_feature now
> trigger fotg210_request_error() (STALL) instead of silently falling
> through to fotg210_set_cxdone().  Also add the missing le16_to_cpu()
> conversion for ctrl->wIndex in fotg210_get_status() to fix a sparse
> endianness warning.
>
> Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>

That's a good catch.
Reviewed-by: Linus Walleij <linusw@xxxxxxxxxx>

Yours,
Linus Walleij