[PATCH 11/13] usb: hub: limit the number of ports to USB_MAXCHILDREN

[Sascha Hauer]

usb_hub_configure() takes the port count straight from the hub
descriptor:

	dev->maxchild = descriptor->bNbrPorts;

children[] in struct usb_device and overcurrent_count[] in struct
usb_hub_device are both sized USB_MAXCHILDREN though, which is 8. A hub that reports
more ports than that - bNbrPorts is a byte, so up to 255 - makes
usb_hub_configure_ports() queue a scan for every one of them, and
usb_scan_port() and usb_hub_port_connect_change() then index both arrays
out of bounds.

The port count is device supplied, so cap it.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
Assisted-by: Claude:claude-opus-5
---
 drivers/usb/core/hub.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 18de8badf5..f897740cbf 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -550,7 +550,17 @@ static int usb_hub_configure(struct usb_device *dev)
 	for (i = 0; i < ((hub->desc.bNbrPorts + 1 + 7)/8); i++)
 		hub->desc.u.hs.PortPwrCtrlMask[i] = descriptor->u.hs.PortPwrCtrlMask[i];
 
+	/*
+	 * bNbrPorts comes from the device, while children[] and
+	 * overcurrent_count[] are sized after USB_MAXCHILDREN. Don't let a
+	 * hub that reports more ports than that write past their ends.
+	 */
 	dev->maxchild = descriptor->bNbrPorts;
+	if (dev->maxchild > USB_MAXCHILDREN) {
+		dev_warn(&dev->dev, "hub reports %d ports, only using %d\n",
+			 dev->maxchild, USB_MAXCHILDREN);
+		dev->maxchild = USB_MAXCHILDREN;
+	}
 	dev_dbg(&dev->dev, "%d ports detected\n", dev->maxchild);
 
 	switch (hub->desc.wHubCharacteristics & HUB_CHAR_LPSM) {

-- 
2.47.3