On Wed, Apr 02, 2025, Frode Isaksen wrote:

From: Frode Isaksen frode@meta.com

The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-bounds access when memcpy'ing the event. Crash log: Unable to handle kernel paging request at virtual address ffffffc0129be000 pc : __memcpy+0x114/0x180 lr : dwc3_check_event_buf+0xec/0x348 x3 : 0000000000000030 x2 : 000000000000dfc4 x1 : ffffffc0129be000 x0 : ffffff87aad60080 Call trace: __memcpy+0x114/0x180 dwc3_interrupt+0x24/0x34

Signed-off-by: Frode Isaksen frode@meta.com Fixes: ebbb2d59398f ("usb: dwc3: gadget: use evt->cache for processing events")

As noted previously, if we must have a Fixes tag, reference to this so it can be backported further back:

Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")

As long as the GEVNTCOUNT has events and not cleared, interrupts will continue to be generated. Driver can continue to service interrupt until GEVNTCOUNT returns a sensible value.

This is not a driver issue, but rather some hardware issue. IMHO, I think it can be fine to omit the Fixes tag. Either way is fine to me.

Thanks, Thinh

Cc: stable@vger.kernel.org

v1 -> v2: Added Fixes and Cc tag. v2 -> v3: Added error log v3 -> v4: Rate limit error log

drivers/usb/dwc3/gadget.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 89a4dc8ebf94..b75b4c5ca7fc 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -4564,6 +4564,12 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt) if (!count) return IRQ_NONE;

• if (count > evt->length) {

• dev_err_ratelimited(dwc->dev, "invalid count(%u) > evt->length(%u)\n",
  

• 	count, evt->length);
  

• return IRQ_NONE;
  

• }
• evt->count = count; evt->flags |= DWC3_EVENT_PENDING;

2.49.0