usb_hub_configure() takes the port count straight from the hub
descriptor:
dev->maxchild = descriptor->bNbrPorts;
children[] in struct usb_device and overcurrent_count[] in struct
usb_hub_device are both sized USB_MAXCHILDREN though, which is 8. A hub that
reports
more ports than that - bNbrPorts is a byte, so up to 255 - makes
usb_hub_configure_ports() queue a scan for every one of them, and
usb_scan_port() and usb_hub_port_connect_change() then index both arrays
out of bounds.
The port count is device supplied, so cap it.
Signed-off-by: Sascha Hauer <[email protected]>
Assisted-by: Claude:claude-opus-5
---
drivers/usb/core/hub.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 18de8badf5..f897740cbf 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -550,7 +550,17 @@ static int usb_hub_configure(struct usb_device *dev)
for (i = 0; i < ((hub->desc.bNbrPorts + 1 + 7)/8); i++)
hub->desc.u.hs.PortPwrCtrlMask[i] =
descriptor->u.hs.PortPwrCtrlMask[i];
+ /*
+ * bNbrPorts comes from the device, while children[] and
+ * overcurrent_count[] are sized after USB_MAXCHILDREN. Don't let a
+ * hub that reports more ports than that write past their ends.
+ */
dev->maxchild = descriptor->bNbrPorts;
+ if (dev->maxchild > USB_MAXCHILDREN) {
+ dev_warn(&dev->dev, "hub reports %d ports, only using %d\n",
+ dev->maxchild, USB_MAXCHILDREN);
+ dev->maxchild = USB_MAXCHILDREN;
+ }
dev_dbg(&dev->dev, "%d ports detected\n", dev->maxchild);
switch (hub->desc.wHubCharacteristics & HUB_CHAR_LPSM) {
--
2.47.3
