Subject: CVE-2021-47182: USB: gadget: detect too-big endpoint 0 requests

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

USB: gadget: detect too-big endpoint 0 requests

Sometimes USB hosts can ask for buffers that are too large from endpoint
0, which should not be allowed.  If this happens for OUT requests, stall
the endpoint, but for IN requests, trim the request size to the endpoint
buffer size.

The Linux kernel CVE team has assigned CVE-2021-47182 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.4.295 with commit 93cd7100fe47
	Fixed in 4.9.293 with commit d2ca6859ea96
	Fixed in 4.14.258 with commit e7c8afee1491
	Fixed in 4.19.221 with commit 13e45e7a262d
	Fixed in 5.4.165 with commit fd6de5a0cd42
	Fixed in 5.10.85 with commit 7193ad3e50e5
	Fixed in 5.15.8 with commit 36dfdf11af49
	Fixed in 5.16 with commit 153a2d7e3350

Please see https://www.kernel.org or a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47182
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/composite.c
	drivers/usb/gadget/legacy/dbgp.c
	drivers/usb/gadget/legacy/inode.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/93cd7100fe47
	https://git.kernel.org/stable/c/d2ca6859ea96
	https://git.kernel.org/stable/c/e7c8afee1491
	https://git.kernel.org/stable/c/13e45e7a262d
	https://git.kernel.org/stable/c/fd6de5a0cd42
	https://git.kernel.org/stable/c/7193ad3e50e5
	https://git.kernel.org/stable/c/36dfdf11af49
	https://git.kernel.org/stable/c/153a2d7e3350