Pengpeng Hou a402532ab8 usb: gadget: bdc: validate status-report endpoint indices ... bdc_sr_xsf() decodes a 5-bit endpoint number from the hardware status report and uses it to index bdc->bdc_ep_array[] directly. The array is only allocated to bdc->num_eps for the current controller instance, so a status report can carry an endpoint number that still fits the 5-bit field but does not fit the runtime-sized endpoint table. Reject status reports whose endpoint number is outside bdc->num_eps before indexing the endpoint array. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Justin Chen <justin.chen@broadcom.com> Link: https://patch.msgid.link/20260323121730.75245-1-pengpeng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2026-03-30 16:47:45 +02:00
..
bdc_cmd.c	usb: gadget: bdc: fix typo in comment	2022-06-10 11:49:12 +02:00
bdc_cmd.h
bdc_core.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
bdc_dbg.c
bdc_dbg.h
bdc_ep.c	usb: gadget: bdc: validate status-report endpoint indices	2026-03-30 16:47:45 +02:00
bdc_ep.h
bdc_udc.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
bdc.h	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
Kconfig
Makefile