I've tested with following patch locally and issue is solved.
Porting fix from: c318840fb2 ("USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug")
Lets ask the syzbot to test the patch also.
#syz test:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 84196390
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 3209b5ddd30c..6e12b60d4f5c 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -393,13 +393,24 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
else
vhci_hcd->port_status[rhport] &= ~USB_PORT_STAT_POWER;
break;
- default:
- usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n",
- wValue);
+ case USB_PORT_FEAT_ENABLE:
+ case USB_PORT_FEAT_C_ENABLE:
+ case USB_PORT_FEAT_C_SUSPEND:
+ /* Not allowed for USB-3 */
+ if (hcd->speed == HCD_USB3)
+ goto error;
+ fallthrough;
+ case USB_PORT_FEAT_C_CONNECTION:
+ case USB_PORT_FEAT_C_RESET:
if (wValue >= 32)
goto error;
vhci_hcd->port_status[rhport] &= ~(1 << wValue);
break;
+ default:
+ /* Disallow INDICATOR and C_OVER_CURRENT */
+ usbip_dbg_vhci_rh(" ClearPortFeature: default %x\n",
+ wValue);
+ goto error;
}
break;
case GetHubDescriptor:
@@ -587,23 +598,22 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
/* 50msec reset signaling */
vhci_hcd->re_timeout = jiffies + msecs_to_jiffies(50);
fallthrough;
+ case USB_PORT_FEAT_C_CONNECTION:
+ case USB_PORT_FEAT_C_RESET:
+ case USB_PORT_FEAT_C_ENABLE:
+ case USB_PORT_FEAT_C_SUSPEND:
+ /* Not allowed for USB-3, and ignored for USB-2 */
+ if (hcd->speed == HCD_USB3)
+ goto error;
+ break;
default:
+ /* Disallow TEST, INDICATOR, and C_OVER_CURRENT */
usbip_dbg_vhci_rh(" SetPortFeature: default %d\n",
wValue);
- if (invalid_rhport) {
+ if (invalid_rhport)
pr_err("invalid port number %d\n", wIndex);
- goto error;
- }
- if (hcd->speed == HCD_USB3) {
- if ((vhci_hcd->port_status[rhport] &
- USB_SS_PORT_STAT_POWER) != 0) {
- vhci_hcd->port_status[rhport] |= (1 << wValue);
- }
- } else
- if ((vhci_hcd->port_status[rhport] &
- USB_PORT_STAT_POWER) != 0) {
- vhci_hcd->port_status[rhport] |= (1 << wValue);
- }
+
+ goto error;
}
break;
case GetPortErrorCount:
--
2.25.1