From 9062d50e75c24dc7911be05c9b1719b3b256af15 Mon Sep 17 00:00:00 2001 From: Liu Chao Date: Mon, 21 Sep 2026 15:25:51 +0800 Subject: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd = (ctrl->bRequest & 0x0F); /* 0 .. 15 */ ... con->data[cmd] = value; /* OOB when cmd >= 5 */ struct usb_audio_control (include/linux/usb/audio.h) declares data as a 5-element array, so indices 5 through 15 write (or read) up to 44 bytes past the end of the array on the heap. A malicious USB host can craft a class-specific SET_CUR / GET_CUR request with an arbitrary bRequest value, triggering the out-of-bounds access from an IRQ completion handler with no further preconditions. Add an ARRAY_SIZE() guard to both functions. Fixes: c47d7b09891a ("USB: audio: add USB audio class definitions") Cc: stable Reviewed-by: Weibin Liu Signed-off-by: Liu Chao Reviewed-by: Ivy Lopez Link: https://patch.msgid.link/20260921072551.3708191-1-liuc63@xiaopeng.com Signed-off-by: Greg Kroah-Hartman --- arch/xtensa/Kconfig.debug | 48 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 arch/xtensa/Kconfig.debug (limited to 'arch/xtensa/Kconfig.debug') diff --git a/arch/xtensa/Kconfig.debug b/arch/xtensa/Kconfig.debug new file mode 100644 index 000000000..e84172a77 --- /dev/null +++ b/arch/xtensa/Kconfig.debug @@ -0,0 +1,48 @@ +# SPDX-License-Identifier: GPL-2.0 + +config DEBUG_TLB_SANITY + bool "Debug TLB sanity" + depends on DEBUG_KERNEL && MMU + help + Enable this to turn on TLB sanity check on each entry to userspace. + This check can spot missing TLB invalidation/wrong PTE permissions/ + premature page freeing. + + If unsure, say N. + +config LD_NO_RELAX + bool "Disable linker relaxation" + default y + help + Enable this function to disable link-time optimizations. + The default linker behavior is to combine identical literal + values to reduce code size and remove unnecessary overhead from + assembler-generated 'longcall' sequences. + Enabling this option improves the link time but increases the + code size, and possibly execution time. + +config S32C1I_SELFTEST + bool "Perform S32C1I instruction self-test at boot" + default y + help + Enable this option to test S32C1I instruction behavior at boot. + Correct operation of this instruction requires some cooperation from hardware + external to the processor (such as bus bridge, bus fabric, or memory controller). + It is easy to make wrong hardware configuration, this test should catch it early. + + Say 'N' on stable hardware. + +config PRINT_STACK_DEPTH + int "Stack depth to print" if DEBUG_KERNEL + default 64 + help + This option allows you to set the stack depth that the kernel + prints in stack traces. + +config PRINT_USER_CODE_ON_UNHANDLED_EXCEPTION + bool "Dump user code around unhandled exception address" + help + Enable this option to display user code around PC of the unhandled + exception (starting at address aligned on 16 byte boundary). + This may simplify finding faulting code in the absence of other + debug facilities. -- cgit v1.3.1