In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC<\/p>\n
When user space sets up FunctionFS with only full-speed descriptors
\n(e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a
\nhigher speed (such as USB_SPEED_HIGH or USB_SPEED_SUPER),
\nconfig_ep_by_speed() detects that the function lacks descriptors for
\nthe current speed, logs a warning, and falls back to full-speed
\ndescriptors. The endpoint is then successfully enabled via
\nusb_ep_enable(), and epfile->ep becomes valid.<\/p>\n
However, when user space subsequently issues the FUNCTIONFS_ENDPOINT_DESC
\nioctl to query the endpoint descriptor, ffs_epfile_ioctl() selects the
\ndescriptor index solely based on gadget->speed:<\/p>\n
\tswitch (epfile->ffs->gadget->speed) {
\n\tcase USB_SPEED_SUPER:
\n\tcase USB_SPEED_SUPER_PLUS:
\n\t\tdesc_idx = 2;
\n\t\tbreak;
\n\tcase USB_SPEED_HIGH:
\n\t\tdesc_idx = 1;
\n\t\tbreak;
\n\tdefault:
\n\t\tdesc_idx = 0;
\n\t}
\n\tdesc = epfile->ep->descs[desc_idx];
\n\tmemcpy(&desc1, desc, desc->bLength);<\/p>\n
Because user space only supplied full-speed descriptors,
\nepfile->ep->descs[1] is NULL. Dereferencing desc->bLength triggers an
\nimmediate kernel NULL pointer dereference panic.<\/p>\n
Fix this by falling back through lower speed descriptors if the current
\nspeed descriptor was not supplied, matching the fallback logic in
\nconfig_ep_by_speed() and historical f_fs behavior. If still missing,
\nfall back to epfile->ep->ep->desc (the active descriptor), and return
\n-EINVAL safely if no valid descriptor is found. In addition, mark desc
\nas const to match struct usb_ep::desc and avoid discarding qualifiers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC<\/p>\n
When user space sets up FunctionFS with only full-spee<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41236","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}