[PATCH] usb: gadget: aspeed: clamp transfer length in RX completion handlers

[Liu Chao <liuc63@xiaopeng.com>]

ast_udc_ep0_out(), ast_udc_epn_handle() and ast_udc_epn_handle_desc()
read the received byte count from hardware registers and add it to
req->req.actual without clamping against the remaining buffer space
(req->req.length - req->req.actual).

When actual reaches or exceeds length, the subsequent DMA has already
written past the end of the request buffer.  Across multiple short
packets the overrun grows with each completion.

A malicious or malfunctioning USB host can exploit this to trigger a
heap buffer overflow in any gadget function (e.g. f_mass_storage,
f_fs) layered on top of this UDC.

Clamp the received length to the remaining space before accumulating
it in all three RX completion paths.

Fixes: 055276c13205 ("usb: gadget: add Aspeed ast2600 udc driver")
Cc: stable@vger.kernel.org
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 drivers/usb/gadget/udc/aspeed_udc.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/gadget/udc/aspeed_udc.c b/drivers/usb/gadget/udc/aspeed_udc.c
index 54f81e668..53f6218b4 100644
--- a/drivers/usb/gadget/udc/aspeed_udc.c
+++ b/drivers/usb/gadget/udc/aspeed_udc.c
@@ -793,6 +793,8 @@ static void ast_udc_ep0_out(struct ast_udc_dev *udc)
 	req = list_entry(ep->queue.next, struct ast_udc_request, queue);
 
 	rx_len = EP0_GET_RX_LEN(ast_udc_read(udc, AST_UDC_EP0_CTRL));
+	if (rx_len > req->req.length - req->req.actual)
+		rx_len = req->req.length - req->req.actual;
 	req->req.actual += rx_len;
 
 	SETUP_DBG(udc, "req %p (%d/%d)\n", req,
@@ -865,6 +867,8 @@ static void ast_udc_epn_handle(struct ast_udc_dev *udc, u16 ep_num)
 	req = list_first_entry(&ep->queue, struct ast_udc_request, queue);
 
 	len = EP_DMA_GET_TX_SIZE(ast_ep_read(ep, AST_UDC_EP_DMA_STS));
+	if (len > req->req.length - req->req.actual)
+		len = req->req.length - req->req.actual;
 	req->req.actual += len;
 
 	EP_DBG(ep, "req @%p, length:(%d/%d), %s:0x%x\n", req,
@@ -944,6 +948,8 @@ static void ast_udc_epn_handle_desc(struct ast_udc_dev *udc, u16 ep_num)
 
 	} while (i != wr_ptr);
 
+	if (total_len > req->req.length - req->req.actual)
+		total_len = req->req.length - req->req.actual;
 	req->req.actual += total_len;
 
 	EP_DBG(ep, "req @%p, length:(%d/%d), %s:0x%x\n", req,
-- 
2.50.1