mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
usb: xhci-mtk: fix issue of out-of-bounds array access
Bus bandwidth array access is based on esit, increase one
will cause out-of-bounds issue; for example, when esit is
XHCI_MTK_MAX_ESIT, will overstep boundary.
Fixes: 7c986fbc16
("usb: xhci-mtk: get the microframe boundary for ESIT")
Cc: <stable@vger.kernel.org>
Reported-by: Stan Lu <stan.lu@mediatek.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/1629189389-18779-5-git-send-email-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
7465d7b66a
commit
de5107f473
1 changed files with 6 additions and 4 deletions
|
@ -575,10 +575,12 @@ static u32 get_esit_boundary(struct mu3h_sch_ep_info *sch_ep)
|
||||||
u32 boundary = sch_ep->esit;
|
u32 boundary = sch_ep->esit;
|
||||||
|
|
||||||
if (sch_ep->sch_tt) { /* LS/FS with TT */
|
if (sch_ep->sch_tt) { /* LS/FS with TT */
|
||||||
/* tune for CS */
|
/*
|
||||||
if (sch_ep->ep_type != ISOC_OUT_EP)
|
* tune for CS, normally esit >= 8 for FS/LS,
|
||||||
boundary++;
|
* not add one for other types to avoid access array
|
||||||
else if (boundary > 1) /* normally esit >= 8 for FS/LS */
|
* out of boundary
|
||||||
|
*/
|
||||||
|
if (sch_ep->ep_type == ISOC_OUT_EP && boundary > 1)
|
||||||
boundary--;
|
boundary--;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue