Skip to content

Commit

Permalink
MdeModulePkg/Bus/Pci: Fix Descriptor Misalignment in USB Config Handling
Browse files Browse the repository at this point in the history 
The issue with locating the expected interface and endpoint descriptors
arises because `configDesc` (USB_CONFIG_DESCRIPTOR) and `IfDesc`
(USB_INTERFACE_DESCRIPTOR) are incremented by structure size rather than
by actual descriptor length.

Specifically:
  - `configDesc` should be incremented by its actual length.
  - `IfDesc` should be incremented by its actual length.

This incorrect increment causes misalignment, preventing access to the
subsequent interface and endpoint descriptors.

[Suggested Solution]
Update the code to increment the pointers by the actual descriptor lengths,
ensuring proper access to all descriptors in the USB configuration.

Signed-off-by: Aniket Surekar <[email protected]>
  • Loading branch information
@AniketSurekar @mergify
AniketSurekar authored and mergify[bot] committed Dec 6, 2024
1 parent e8668d2 commit 333e963
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 10 deletions.
12 changes: 6 additions & 6 deletions MdeModulePkg/Bus/Pci/XhciDxe/XhciSched.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2848,7 +2848,7 @@ XhcInitializeEndpointContext (
MaxDci = 1;
}

EpDesc = (USB_ENDPOINT_DESCRIPTOR *)(IfDesc + 1);
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
for (EpIndex = 0; EpIndex < NumEp; EpIndex++) {
while (EpDesc->DescriptorType != USB_DESC_TYPE_ENDPOINT) {
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);
Expand Down Expand Up @@ -3051,7 +3051,7 @@ XhcInitializeEndpointContext64 (
MaxDci = 1;
}

EpDesc = (USB_ENDPOINT_DESCRIPTOR *)(IfDesc + 1);
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
for (EpIndex = 0; EpIndex < NumEp; EpIndex++) {
while (EpDesc->DescriptorType != USB_DESC_TYPE_ENDPOINT) {
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);
Expand Down Expand Up @@ -3260,7 +3260,7 @@ XhcSetConfigCmd (

MaxDci = 0;

IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)ConfigDesc + ConfigDesc->Length);
for (Index = 0; Index < ConfigDesc->NumInterfaces; Index++) {
while ((IfDesc->DescriptorType != USB_DESC_TYPE_INTERFACE) || (IfDesc->AlternateSetting != 0)) {
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
Expand Down Expand Up @@ -3353,7 +3353,7 @@ XhcSetConfigCmd64 (

MaxDci = 0;

IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)ConfigDesc + ConfigDesc->Length);
for (Index = 0; Index < ConfigDesc->NumInterfaces; Index++) {
while ((IfDesc->DescriptorType != USB_DESC_TYPE_INTERFACE) || (IfDesc->AlternateSetting != 0)) {
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
Expand Down Expand Up @@ -3644,7 +3644,7 @@ XhcSetInterface (
IfDescActive = NULL;
IfDescSet = NULL;

IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)ConfigDesc + ConfigDesc->Length);
while ((UINTN)IfDesc < ((UINTN)ConfigDesc + ConfigDesc->TotalLength)) {
if ((IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) && (IfDesc->Length >= sizeof (USB_INTERFACE_DESCRIPTOR))) {
if (IfDesc->InterfaceNumber == (UINT8)Request->Index) {
Expand Down Expand Up @@ -3851,7 +3851,7 @@ XhcSetInterface64 (
IfDescActive = NULL;
IfDescSet = NULL;

IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)ConfigDesc + ConfigDesc->Length);
while ((UINTN)IfDesc < ((UINTN)ConfigDesc + ConfigDesc->TotalLength)) {
if ((IfDesc->DescriptorType == USB_DESC_TYPE_INTERFACE) && (IfDesc->Length >= sizeof (USB_INTERFACE_DESCRIPTOR))) {
if (IfDesc->InterfaceNumber == (UINT8)Request->Index) {
Expand Down
8 changes: 4 additions & 4 deletions MdeModulePkg/Bus/Pci/XhciPei/XhciSched.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1748,7 +1748,7 @@ XhcPeiSetConfigCmd (

MaxDci = 0;

IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)ConfigDesc + ConfigDesc->Length);
for (Index = 0; Index < ConfigDesc->NumInterfaces; Index++) {
while ((IfDesc->DescriptorType != USB_DESC_TYPE_INTERFACE) || (IfDesc->AlternateSetting != 0)) {
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
Expand All @@ -1759,7 +1759,7 @@ XhcPeiSetConfigCmd (
MaxDci = 1;
}

EpDesc = (USB_ENDPOINT_DESCRIPTOR *)(IfDesc + 1);
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
for (EpIndex = 0; EpIndex < NumEp; EpIndex++) {
while (EpDesc->DescriptorType != USB_DESC_TYPE_ENDPOINT) {
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);
Expand Down Expand Up @@ -1974,7 +1974,7 @@ XhcPeiSetConfigCmd64 (

MaxDci = 0;

IfDesc = (USB_INTERFACE_DESCRIPTOR *)(ConfigDesc + 1);
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)ConfigDesc + ConfigDesc->Length);
for (Index = 0; Index < ConfigDesc->NumInterfaces; Index++) {
while ((IfDesc->DescriptorType != USB_DESC_TYPE_INTERFACE) || (IfDesc->AlternateSetting != 0)) {
IfDesc = (USB_INTERFACE_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
Expand All @@ -1985,7 +1985,7 @@ XhcPeiSetConfigCmd64 (
MaxDci = 1;
}

EpDesc = (USB_ENDPOINT_DESCRIPTOR *)(IfDesc + 1);
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)IfDesc + IfDesc->Length);
for (EpIndex = 0; EpIndex < NumEp; EpIndex++) {
while (EpDesc->DescriptorType != USB_DESC_TYPE_ENDPOINT) {
EpDesc = (USB_ENDPOINT_DESCRIPTOR *)((UINTN)EpDesc + EpDesc->Length);
Expand Down

0 comments on commit 333e963

Please sign in to comment.