Message ID | 20180319065002.2495-1-xypron.glpk@gmx.de |
---|---|
State | Rejected, archived |
Delegated to: | Marek Vasut |
Headers | show |
Series | [U-Boot,v2,1/1] usb: musb-new: misplaced out of bounds check | expand |
On 03/19/2018 07:50 AM, Heinrich Schuchardt wrote: > musb->endpoints[] has array size MUSB_C_NUM_EPS. > We must check array bounds before accessing the array and not afterwards. > > Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> > --- > v2 > do not move the ep->desc check > --- Upstreamed as https://lkml.org/lkml/2018/3/19/52
diff --git a/drivers/usb/musb-new/musb_gadget_ep0.c b/drivers/usb/musb-new/musb_gadget_ep0.c index 3cfcb2205a..aa57a7767d 100644 --- a/drivers/usb/musb-new/musb_gadget_ep0.c +++ b/drivers/usb/musb-new/musb_gadget_ep0.c @@ -95,6 +95,11 @@ static int service_tx_status_request( break; } + if (epnum >= MUSB_C_NUM_EPS) { + handled = -EINVAL; + break; + } + is_in = epnum & USB_DIR_IN; if (is_in) { epnum &= 0x0f; @@ -104,7 +109,7 @@ static int service_tx_status_request( } regs = musb->endpoints[epnum].regs; - if (epnum >= MUSB_C_NUM_EPS || !ep->desc) { + if (!ep->desc) { handled = -EINVAL; break; }
musb->endpoints[] has array size MUSB_C_NUM_EPS. We must check array bounds before accessing the array and not afterwards. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> --- v2 do not move the ep->desc check --- drivers/usb/musb-new/musb_gadget_ep0.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)