On Thu, Apr 03, 2025, Frode Isaksen wrote:

From: Frode Isaksen frode@meta.com

The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-bounds access when memcpy'ing the event. Crash log: Unable to handle kernel paging request at virtual address ffffffc0129be000 pc : __memcpy+0x114/0x180 lr : dwc3_check_event_buf+0xec/0x348 x3 : 0000000000000030 x2 : 000000000000dfc4 x1 : ffffffc0129be000 x0 : ffffff87aad60080 Call trace: __memcpy+0x114/0x180 dwc3_interrupt+0x24/0x34

Signed-off-by: Frode Isaksen frode@meta.com Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable@vger.kernel.org

---

v1 -> v2: Added Fixes and Cc tag. v2 -> v3: Added error log v3 -> v4: Rate limit error log v4 -> v5: Changed Fixes tag

drivers/usb/dwc3/gadget.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 89a4dc8ebf94..b75b4c5ca7fc 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -4564,6 +4564,12 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt) if (!count) return IRQ_NONE;

• if (count > evt->length) {

• dev_err_ratelimited(dwc->dev, "invalid count(%u) > evt->length(%u)\n",
  

• 	count, evt->length);
  

• return IRQ_NONE;
  

• }
• evt->count = count; evt->flags |= DWC3_EVENT_PENDING;

2.49.0

Acked-by: Thinh Nguyen Thinh.Nguyen@synopsys.com

Thanks, Thinh