USB: usb_parse_endpoint: ignore reserved bits

Reading bEndpointAddress the spec tells is that:
  b7   is direction, which must be ignored
  b6:4 are reserved which are to be set to zero
  b3:0 are the endpoint address

In order to be backwards compatible with possible future versions of USB
we have to be ready with devices using those bits. That means that we
also have to ignore them like we do with the direction bit.

In consequence the only illegal address you can encoding in four bits is
endpoint zero, for which no descriptor must exist. Hence the check for
exceeding the upper limit on endpoint addresses is removed.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20240502115259.31076-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 7f8d33f92ddb5f5cfa3dbb0c9b845cd4f2903e78..3362af165ef5a629a4467a37caa238a79f33a326 100644 (file)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -279,11 +279,11 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
                goto skip_to_next_endpoint_or_interface_descriptor;
        }
 
-       i = d->bEndpointAddress & ~USB_ENDPOINT_DIR_MASK;
-       if (i >= 16 || i == 0) {
+       i = d->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+       if (i == 0) {
                dev_notice(ddev, "config %d interface %d altsetting %d has an "
-                   "invalid endpoint with address 0x%X, skipping\n",
-                   cfgno, inum, asnum, d->bEndpointAddress);
+                   "invalid descriptor for endpoint zero, skipping\n",
+                   cfgno, inum, asnum);
                goto skip_to_next_endpoint_or_interface_descriptor;
        }