[PATCH] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[PATCH] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[Fang Xieyan]

ep_from_windex() uses idx > hsotg->num_of_eps to validate the
endpoint index. Since valid indices are below num_of_eps, an index
equal to num_of_eps passes the check and is used to access
eps_in[] or eps_out[] out of bounds. This can cause an unintended
endpoint pointer to be used by subsequent request handling.

Reject indices greater than or equal to num_of_eps to prevent the
out-of-bounds access.

Fixes: b3f489b2b658 ("usb:hsotg:samsung: Determine number of EPs from HW configuration register")
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
 drivers/usb/dwc2/gadget.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0637bfbc0..b2a25cd5c 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1582,7 +1582,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
 	if (windex >= 0x100)
 		return NULL;
 
-	if (idx > hsotg->num_of_eps)
+	if (idx >= hsotg->num_of_eps)
 		return NULL;
 
 	return index_to_ep(hsotg, idx, dir);
--
2.50.1

Re: [PATCH] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[Fang Xieyan]

Adding Thinh Nguyen to the discussion as the DWC2 maintainer.

The original email to Minas Harutyunyan's address was bounced.

Re: [PATCH] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[Thinh Nguyen]

On Mon, Oct 26, 2026, Fang Xieyan wrote:
> ep_from_windex() uses idx > hsotg->num_of_eps to validate the
> endpoint index. Since valid indices are below num_of_eps, an index
> equal to num_of_eps passes the check and is used to access
> eps_in[] or eps_out[] out of bounds. This can cause an unintended
> endpoint pointer to be used by subsequent request handling.

Not quite. The OOB access only happens when num_of_eps ==
MAX_EPS_CHANNELS, Otherwise, eps_in/out[] are zero-initialized, so
index_to_ep() returns NULL and the request is already rejected.

> 
> Reject indices greater than or equal to num_of_eps to prevent the
> out-of-bounds access.
> 
> Fixes: b3f489b2b658 ("usb:hsotg:samsung: Determine number of EPs from HW configuration register")

This points to the wrong commit. num_of_eps didn't include EP0 there. It
should be:

Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")

And please Cc stable.

Thanks,
Thinh