Messages in this thread | | | Subject | Re: [PATCH v2 1/1] usb: musb: gadget: misplaced out of bounds check | From | Sergei Shtylyov <> | Date | Tue, 20 Mar 2018 12:36:30 +0300 |
| |
Hello!
On 3/20/2018 5:27 AM, Heinrich Schuchardt wrote:
> musb->endpoints[] has array size MUSB_C_NUM_EPS. > We must check array bounds before accessing the array and not afterwards. > > Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> > --- > v2 > Only the 4 low bits of epnum are relevant for indexing. > --- > drivers/usb/musb/musb_gadget_ep0.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c > index 18da4873e52e..96b0fa12f729 100644 > --- a/drivers/usb/musb/musb_gadget_ep0.c > +++ b/drivers/usb/musb/musb_gadget_ep0.c > @@ -89,15 +89,20 @@ static int service_tx_status_request( > } > > is_in = epnum & USB_DIR_IN; > + epnum &= 0x0f; > + if (epnum >= MUSB_C_NUM_EPS) { > + handled = -EINVAL; > + break; > + } > + > if (is_in) { > - epnum &= 0x0f; > ep = &musb->endpoints[epnum].ep_in; > } else { > ep = &musb->endpoints[epnum].ep_out; > }
Please remove the braces, they're not needed anymore.
[...]
MBR, Sergei
| |