[PATCH] usb: gadget: composite: pass the validated interface index

[Aldo Ariel Panzardo]

composite_setup() validates the low byte of wIndex as an interface
number, but passes the full 16-bit wIndex to the function's get_alt and
set_alt callbacks.  FunctionFS reverse-maps the low byte and then uses
the original callback argument to index its fixed-size cur_alt array.

Pass the decoded and validated interface number to the callbacks.  This
matches the callback contract and prevents an out-of-bounds cur_alt
access when the high byte of wIndex is nonzero.

Fixes: 2f550553e23c ("usb: gadget: f_fs: Add the missing get_alt callback")
Reported-by: Chris Mason <clm@xxxxxxxx>
Link: https://lore.kernel.org/r/3984c9bd-2ac8-424e-9390-7170fdab3c03@xxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
---
 drivers/usb/gadget/composite.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index df39e3487..2aa07eafc 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1930,7 +1930,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 			break;
 
 		spin_lock(&cdev->lock);
-		value = f->set_alt(f, w_index, w_value);
+		value = f->set_alt(f, intf, w_value);
 		if (value == USB_GADGET_DELAYED_STATUS) {
 			DBG(cdev,
 			 "%s: interface %d (%s) requested delayed status\n",
@@ -1950,7 +1950,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 		if (!f)
 			break;
 		/* lots of interfaces only need altsetting zero... */
-		value = f->get_alt ? f->get_alt(f, w_index) : 0;
+		value = f->get_alt ? f->get_alt(f, intf) : 0;
 		if (value < 0)
 			break;
 		*((u8 *)req->buf) = value;
-- 
2.43.0