mirror of https://github.com/torvalds/linux.git
63ccd26cd1
The event count is read from register DWC3_GEVNTCOUNT.
There is a check for the count being zero, but not for exceeding the
event buffer length.
Check that event count does not exceed event buffer length,
avoiding an out-of-bounds access when memcpy'ing the event.
Crash log:
Unable to handle kernel paging request at virtual address ffffffc0129be000
pc : __memcpy+0x114/0x180
lr : dwc3_check_event_buf+0xec/0x348
x3 : 0000000000000030 x2 : 000000000000dfc4
x1 : ffffffc0129be000 x0 : ffffff87aad60080
Call trace:
__memcpy+0x114/0x180
dwc3_interrupt+0x24/0x34
Signed-off-by: Frode Isaksen <frode@meta.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| core.c | ||
| core.h | ||
| debug.h | ||
| debugfs.c | ||
| drd.c | ||
| dwc3-am62.c | ||
| dwc3-exynos.c | ||
| dwc3-haps.c | ||
| dwc3-imx8mp.c | ||
| dwc3-keystone.c | ||
| dwc3-meson-g12a.c | ||
| dwc3-octeon.c | ||
| dwc3-of-simple.c | ||
| dwc3-omap.c | ||
| dwc3-pci.c | ||
| dwc3-qcom.c | ||
| dwc3-rtk.c | ||
| dwc3-st.c | ||
| dwc3-xilinx.c | ||
| ep0.c | ||
| gadget.c | ||
| gadget.h | ||
| host.c | ||
| io.h | ||
| trace.c | ||
| trace.h | ||
| ulpi.c | ||