[PATCH v2] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[PATCH v2] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[Fang Xieyan]

ep_from_windex() checks whether idx is greater than
hsotg->num_of_eps. However, num_of_eps includes EP0, so valid
endpoint indices are in the range [0, num_of_eps - 1].

When idx equals num_of_eps, index_to_ep() accesses the endpoint
array beyond the configured range. This results in an out-of-bounds
access when num_of_eps equals MAX_EPS_CHANNELS. Otherwise, the
zero-initialized array entry is NULL and the request is rejected.

Reject indices greater than or equal to num_of_eps.

Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
Cc: stable@vger.kernel.org
Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
---
Changes in v2:
 - Fixes corrected to c6f5c050e2a7 per Thinh's review
 - Narrow commit message: OOB only when num_of_eps == MAX_EPS_CHANNELS
 - Add Cc: stable@vger.kernel.org

Link: https://lore.kernel.org/linux-usb/20261026031138.35911-1-fangxy@xiaopeng.com/

 drivers/usb/dwc2/gadget.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 0637bfbc0..b2a25cd5c 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1582,7 +1582,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
 	if (windex >= 0x100)
 		return NULL;
 
-	if (idx > hsotg->num_of_eps)
+	if (idx >= hsotg->num_of_eps)
 		return NULL;
 
 	return index_to_ep(hsotg, idx, dir);
--
2.50.1

Re: [PATCH v2] usb: dwc2: gadget: fix off-by-one in ep_from_windex bounds check

[Thinh Nguyen]

On Thu, Nov 05, 2026, Fang Xieyan wrote:
> ep_from_windex() checks whether idx is greater than
> hsotg->num_of_eps. However, num_of_eps includes EP0, so valid
> endpoint indices are in the range [0, num_of_eps - 1].
> 
> When idx equals num_of_eps, index_to_ep() accesses the endpoint
> array beyond the configured range. This results in an out-of-bounds
> access when num_of_eps equals MAX_EPS_CHANNELS. Otherwise, the
> zero-initialized array entry is NULL and the request is rejected.
> 
> Reject indices greater than or equal to num_of_eps.
> 
> Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support")
> Cc: stable@vger.kernel.org
> Reviewed-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
> ---
> Changes in v2:
>  - Fixes corrected to c6f5c050e2a7 per Thinh's review
>  - Narrow commit message: OOB only when num_of_eps == MAX_EPS_CHANNELS
>  - Add Cc: stable@vger.kernel.org
> 
> Link: https://urldefense.com/v3/__https://lore.kernel.org/linux-usb/20261026031138.35911-1-fangxy@xiaopeng.com/__;!!A4F2R9G_pg!ZovDIgRJmn8Uy10yvLnZUW3A_KjatMCOBhg2QDQcr5pST9_mRVkSaolpA8I98TBkeWY6pWToRAdzHC3jXKdD0Q$ 
> 
>  drivers/usb/dwc2/gadget.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
> index 0637bfbc0..b2a25cd5c 100644
> --- a/drivers/usb/dwc2/gadget.c
> +++ b/drivers/usb/dwc2/gadget.c
> @@ -1582,7 +1582,7 @@ static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg,
>  	if (windex >= 0x100)
>  		return NULL;
>  
> -	if (idx > hsotg->num_of_eps)
> +	if (idx >= hsotg->num_of_eps)
>  		return NULL;
>  
>  	return index_to_ep(hsotg, idx, dir);
> --
> 2.50.1
> 

Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>

Thanks,
Thinh