[PATCH RESEND] drivers: usb: gadget: composite: add checking for interface number

[Arseniy Krasnov]

Hi, sorry, pls ping


On 12.03.2025 10:53, Arseniy Krasnov wrote:
> Hi, sorry, pls ping
> 
> On 03.02.2025 18:55, Vladimir Mitrofanov wrote:
>> Some proprietary protocols uses "w_index" field not by the rules.
>> When we set "intf = w_index & 0xFF" variable without check it may
>> exceed maximum number of interfaces. Not all code cases below check
>> the range of this variable. In some protocols it is usefull to
>> guaranty that "intf" not exceed MAX_CONFIG_INTERFACES.
>>
>> Fixes: 7010f5b94fa3 ("usb:gadget:composite USB composite gadget support")
>> Signed-off-by: Vladimir Mitrofanov <vvmitrofanov at salutedevices.com>
>> ---
>>  drivers/usb/gadget/composite.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
>> index 04b8541993..4bb2afa833 100644
>> --- a/drivers/usb/gadget/composite.c
>> +++ b/drivers/usb/gadget/composite.c
>> @@ -1011,7 +1011,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
>>  	u16				w_index = le16_to_cpu(ctrl->wIndex);
>>  	u16				w_value = le16_to_cpu(ctrl->wValue);
>>  	struct usb_composite_dev	*cdev = get_gadget_data(gadget);
>> -	u8				intf = w_index & 0xFF;
>> +	u8				intf = min_t(u8, w_index & 0xFF, MAX_CONFIG_INTERFACES - 1);
>>  	int				value = -EOPNOTSUPP;
>>  	struct usb_request		*req = cdev->req;
>>  	struct usb_function		*f = NULL;