| From e86103a75705c7c530768f4ffaba74cf382910f2 Mon Sep 17 00:00:00 2001 |
| From: Robert Dobrowolski <robert.dobrowolski@linux.intel.com> |
| Date: Thu, 24 Mar 2016 03:30:07 -0700 |
| Subject: usb: hcd: out of bounds access in for_each_companion |
| |
| From: Robert Dobrowolski <robert.dobrowolski@linux.intel.com> |
| |
| commit e86103a75705c7c530768f4ffaba74cf382910f2 upstream. |
| |
| On BXT platform Host Controller and Device Controller figure as |
| same PCI device but with different device function. HCD should |
| not pass data to Device Controller but only to Host Controllers. |
| Checking if companion device is Host Controller, otherwise skip. |
| |
| Signed-off-by: Robert Dobrowolski <robert.dobrowolski@linux.intel.com> |
| Acked-by: Alan Stern <stern@rowland.harvard.edu> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/core/hcd-pci.c | 9 +++++++++ |
| 1 file changed, 9 insertions(+) |
| |
| --- a/drivers/usb/core/hcd-pci.c |
| +++ b/drivers/usb/core/hcd-pci.c |
| @@ -74,6 +74,15 @@ static void for_each_companion(struct pc |
| if (companion->bus != pdev->bus || |
| PCI_SLOT(companion->devfn) != slot) |
| continue; |
| + |
| + /* |
| + * Companion device should be either UHCI,OHCI or EHCI host |
| + * controller, otherwise skip. |
| + */ |
| + if (companion->class != CL_UHCI && companion->class != CL_OHCI && |
| + companion->class != CL_EHCI) |
| + continue; |
| + |
| companion_hcd = pci_get_drvdata(companion); |
| if (!companion_hcd || !companion_hcd->self.root_hub) |
| continue; |
