On Wed, Apr 02, 2025, Frode Isaksen wrote:
From: Frode Isaksen frode@meta.com
The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-bounds access when memcpy'ing the event. Crash log: Unable to handle kernel paging request at virtual address ffffffc0129be000 pc : __memcpy+0x114/0x180 lr : dwc3_check_event_buf+0xec/0x348 x3 : 0000000000000030 x2 : 000000000000dfc4 x1 : ffffffc0129be000 x0 : ffffff87aad60080 Call trace: __memcpy+0x114/0x180 dwc3_interrupt+0x24/0x34
Signed-off-by: Frode Isaksen frode@meta.com Fixes: ebbb2d59398f ("usb: dwc3: gadget: use evt->cache for processing events")
As noted previously, if we must have a Fixes tag, reference to this so it can be backported further back:
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
As long as the GEVNTCOUNT has events and not cleared, interrupts will continue to be generated. Driver can continue to service interrupt until GEVNTCOUNT returns a sensible value.
This is not a driver issue, but rather some hardware issue. IMHO, I think it can be fine to omit the Fixes tag. Either way is fine to me.
Thanks, Thinh
Cc: stable@vger.kernel.org
v1 -> v2: Added Fixes and Cc tag. v2 -> v3: Added error log v3 -> v4: Rate limit error log
drivers/usb/dwc3/gadget.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 89a4dc8ebf94..b75b4c5ca7fc 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -4564,6 +4564,12 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt) if (!count) return IRQ_NONE;
- if (count > evt->length) {
dev_err_ratelimited(dwc->dev, "invalid count(%u) > evt->length(%u)\n",
count, evt->length);
return IRQ_NONE;
- }
- evt->count = count; evt->flags |= DWC3_EVENT_PENDING;
2.49.0