From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f228.google.com (mail-qt1-f228.google.com [209.85.160.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 930353B19A3 for ; Tue, 24 Mar 2026 18:45:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.228 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774377925; cv=none; b=HJSkBs0L6Ex+4Kk2g9MLNNsYf5C5WFyktelc2lxIAh0O8ZwqC4wEarRcjE4qbU62IC7T6asqlpTE+rkVd0QjTMwA19xx6rzTO/CDdKjOfQH1PHNmuK/8RYLeYnTg0W7gFNe104atuOtc23k538DTntg75cQ/GDdLtT5FkalA7aQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774377925; c=relaxed/simple; bh=zgIDjGBLHYRXKjHT62Y8zHCcmWlzgS1goIgHk7PM6/U=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=MAcgc/8/NPxci1qctwhlGqrK45GgYIBRwUkQIwVgxxBdVHzOzWt4ffPY5nfX37To4ZVhjYMB6lH9qaBT4NImoAUe2mdoHBetWnP1+XaqDl/JrEOPJsjhxjH5w/npTWHfsOGK5TQ0ykWbpWkXhQwqfifGjMLs+O+JDrsE/yG7tz0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=UlHyNi2l; arc=none smtp.client-ip=209.85.160.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="UlHyNi2l" Received: by mail-qt1-f228.google.com with SMTP id d75a77b69052e-50b713d6baeso10921931cf.2 for ; Tue, 24 Mar 2026 11:45:24 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774377923; x=1774982723; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=qV3+ksbhWzQ3JWuKsMBNviGlAsd2rzdqL3CoeGDVw0U=; b=n6X3YcD2HRwSQTuzmNVkLVYNYcTlTpQSRvYhaMP1CnzzficGkToJkb4ZuMjzgdAtQU aomGmBjqgBh+x0+ENcRxvsU12JhPnMxO36pom1m/4akBGo1Isj26lX6WcYP6uxXO95kB 0kH4/457TkhsdPzikysSXHttX9M5TGz77QjXovVy6C88zr3PEky+Sc+jMoTofqV7nQT4 9pO+sEewiRp7PaJVZJSqo5RxQfYakqBRKKI9EMUIdbHapa7ENIC6O25ZXTBNNJLeJDKT j4d4WKaEqipxEJwO0KP9RwEexaFv/M2OTqf2vDZ0AjU8RFPdJt1PRLGbITBonhygMkUj DWRg== X-Forwarded-Encrypted: i=1; AJvYcCXXtaq/EUCi3UsumR5jybwofloRG+NM5G1GUR6YuTlhOXJjdwEIDCw3YR5T+2mqfvctjjcQVXbxQQ/5tXg=@vger.kernel.org X-Gm-Message-State: AOJu0YyNU0wAs5seMoSsVC+ByMQLj6Il9S5lgE33gXa2XEfxx+7tBNzI X2VBR23wgqME3bEv6IWRA7Kf9goKu/KFaXlrmPeS6B6/Q4fk3pUR4WZE0J1rIFll6s6HvXzCcGz Ld3zXAxsxS9wkFM3omROnTNbw8hFXiAuMVOu1TNnW97wpCfPNOncRlZGTrAIDLSLenD74tRc6l9 /3iWse2S9F2msE/gZr6LmZeip0yZwZpmrEqgAnGHr/IpwEFdh0zgQ0SgiaL4zjgm9pVFW3o6FMi YPkturOmhLO/P3/Tg== X-Gm-Gg: ATEYQzyWJ/HPjg69HBPjtHFb3n6nn5JnleCPcE/w3UpEcL0mPWRpkejjLVhzCp4C2FY vja8QP/8EFIHr59IbsV60lbD5SQ+4MZux1Tq9jificYbZihb1mdqBxX18wyGu0UmW7TIrkj/hu+ f9J7hALM9Ev0Ej0nz5CPPpXyS5E4PwuAzfDfqfb9LFcFq2bEBiKmX+RNL6YN0+NvBYLUCzVzSpK kc4Jhtl4umC0+5zRpBJrxGsV6ecna7x2dCE9iGbw2IvLCGPcIl8EYTfdlTYD6n0MAiRwdh6nHWg nKIFGaC+oMOxzs1J+OrvhJFWPON89ntMgGB7ZUrYPNEMOReTvwTgt9JylkPTWD+JxhPfmifuagX Tfti9eH0jywSragxuNRk5CuzbM+U7srnF5FHr7mUBfqexxwnP8+sjJc/oh03Nr8jYquCEl/P7Li /ITBnmQy2gvK/tk1AQwVdffpZgpFFicXlFJqAgdxviRlDqms/fPkRTcyCh8w== X-Received: by 2002:ac8:5783:0:b0:50b:382e:f09a with SMTP id d75a77b69052e-50b80e2ea85mr11187511cf.33.1774377923207; Tue, 24 Mar 2026 11:45:23 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-102.dlp.protect.broadcom.com. [144.49.247.102]) by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-89cc1df287bsm1072386d6.23.2026.03.24.11.45.22 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 24 Mar 2026 11:45:23 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-8cfba9b4eb3so1203212185a.3 for ; Tue, 24 Mar 2026 11:45:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1774377922; x=1774982722; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=qV3+ksbhWzQ3JWuKsMBNviGlAsd2rzdqL3CoeGDVw0U=; b=UlHyNi2lyg5CCYzCqLljFbYUWyg0PHpggNSe2imt4YEx6JJ6UejbXtxmpAyE1ctIMn DdPICSpDJnid+m3H0pmAgQhKDo/8yi9sOGnI1ucbVVChbb6HOba5ONKUzfT8pEL4st92 2kbosDHJW75cbnnR3Rz2NW/pf/PPDlcgn5bcA= X-Forwarded-Encrypted: i=1; AJvYcCUS887g6JwcEt6rhRXDOVbxpuqV2ML6d1uQ+yp8A+IrH2REbx/lELElfeaHjC555J6NiBSTtDprbHHfbZc=@vger.kernel.org X-Received: by 2002:a05:620a:690f:b0:8cf:c218:739b with SMTP id af79cd13be357-8d000f3b707mr94337685a.18.1774377922375; Tue, 24 Mar 2026 11:45:22 -0700 (PDT) X-Received: by 2002:a05:620a:690f:b0:8cf:c218:739b with SMTP id af79cd13be357-8d000f3b707mr94330385a.18.1774377921695; Tue, 24 Mar 2026 11:45:21 -0700 (PDT) Received: from [10.14.5.144] ([192.19.161.248]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8cfc9088df1sm1144053285a.25.2026.03.24.11.45.18 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 24 Mar 2026 11:45:20 -0700 (PDT) Message-ID: <6c46d196-bb77-4a7c-aeab-d167747fcd11@broadcom.com> Date: Tue, 24 Mar 2026 11:45:17 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] usb: gadget: bdc: validate status-report endpoint indices To: Florian Fainelli , Pengpeng Hou Cc: alcooperx@gmail.com, bcm-kernel-feedback-list@broadcom.com, gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260323121730.75245-1-pengpeng@iscas.ac.cn> <89a5cf0e-444a-42d3-b7cb-49ce2560995c@broadcom.com> Content-Language: en-US From: Justin Chen In-Reply-To: <89a5cf0e-444a-42d3-b7cb-49ce2560995c@broadcom.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e On 3/23/26 12:20 PM, Florian Fainelli wrote: > On 3/23/26 05:17, Pengpeng Hou wrote: >> bdc_sr_xsf() decodes a 5-bit endpoint number from the hardware status >> report and uses it to index bdc->bdc_ep_array[] directly. The array is >> only allocated to bdc->num_eps for the current controller instance, so a >> status report can carry an endpoint number that still fits the 5-bit >> field but does not fit the runtime-sized endpoint table. >> >> Reject status reports whose endpoint number is outside bdc->num_eps >> before indexing the endpoint array. >> >> Signed-off-by: Pengpeng Hou > > Reviewed-by: Florian Fainelli Tested-by: Justin Chen