mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 16:49:22 +00:00
usb: musb: gadget: misplaced out of bounds check
musb->endpoints[] has array size MUSB_C_NUM_EPS. We must check array bounds before accessing the array and not afterwards. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Bin Liu <b-liu@ti.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
be9cae2479
commit
af6f852909
1 changed files with 10 additions and 6 deletions
|
@ -89,15 +89,19 @@ static int service_tx_status_request(
|
|||
}
|
||||
|
||||
is_in = epnum & USB_DIR_IN;
|
||||
if (is_in) {
|
||||
epnum &= 0x0f;
|
||||
ep = &musb->endpoints[epnum].ep_in;
|
||||
} else {
|
||||
ep = &musb->endpoints[epnum].ep_out;
|
||||
epnum &= 0x0f;
|
||||
if (epnum >= MUSB_C_NUM_EPS) {
|
||||
handled = -EINVAL;
|
||||
break;
|
||||
}
|
||||
|
||||
if (is_in)
|
||||
ep = &musb->endpoints[epnum].ep_in;
|
||||
else
|
||||
ep = &musb->endpoints[epnum].ep_out;
|
||||
regs = musb->endpoints[epnum].regs;
|
||||
|
||||
if (epnum >= MUSB_C_NUM_EPS || !ep->desc) {
|
||||
if (!ep->desc) {
|
||||
handled = -EINVAL;
|
||||
break;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue