U-Boot takes several counts from the descriptors of a USB device and uses them to index fixed-size arrays without checking them. A device, or a hub, whose counts claim more than it describes, or more than U-Boot has room for, makes enumeration and the class drivers read and write past those arrays.
This series checks each of them where it is parsed: 1. USB_MAXCHILDREN goes from 8 to 31, as in Linux, as xHCI root hubs often have more than 8 ports 2. usb_hub_configure() uses at most USB_MAXCHILDREN ports of a hub 3. usb tree, without driver model, no longer reads one past the ports 4. usb_parse_config() lowers bNumInterfaces and each bNumEndpoints to what it stored, and keeps what fits of a device with more interfaces or endpoints than there is room for 5. usb_parse_config() skips endpoint descriptors for endpoint zero, which xhci_get_ep_index() turns into the endpoint index -1 6. usb_select_config() drops a device whose configuration can't be parsed The tests for patches 2 and 4 to 6 use the sandbox USB emulators. With sandbox_defconfig and CONFIG_ASAN, the five new tests fail on main and pass with the series applied, each patch builds and passes the tests present at that point, and the whole ut dm suite still passes. CI: Azure build 13714 passed, all jobs, with this series on https://github.com/u-boot/u-boot/pull/1064, a CI-only pull request, merged with main 3973f3c4d24: https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13714 Ana Bobillo (6): usb: raise USB_MAXCHILDREN to 31 usb: hub: don't use more ports than USB_MAXCHILDREN cmd: usb: don't look past the last port in usb tree usb: keep interface and endpoint counts within what was parsed usb: skip endpoint descriptors for endpoint zero usb: don't use a device whose configuration can't be parsed cmd/usb.c | 2 +- common/usb.c | 38 ++++- common/usb_hub.c | 21 ++- drivers/usb/emul/sandbox_hub.c | 40 ++++- include/usb.h | 2 +- test/dm/usb.c | 262 +++++++++++++++++++++++++++++++++ 6 files changed, 350 insertions(+), 15 deletions(-) base-commit: 3973f3c4d24df75ca90d7c0a9f03e5e5c9b48f32
