| From: Heinrich Schuchardt <xypron.glpk@gmx.de> |
| Date: Thu, 29 Mar 2018 10:48:28 -0500 |
| Subject: usb: musb: gadget: misplaced out of bounds check |
| |
| commit af6f8529098aeb0e56a68671b450cf74e7a64fcd upstream. |
| |
| musb->endpoints[] has array size MUSB_C_NUM_EPS. |
| We must check array bounds before accessing the array and not afterwards. |
| |
| Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> |
| Signed-off-by: Bin Liu <b-liu@ti.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/usb/musb/musb_gadget_ep0.c | 14 +++++++++----- |
| 1 file changed, 9 insertions(+), 5 deletions(-) |
| |
| --- a/drivers/usb/musb/musb_gadget_ep0.c |
| +++ b/drivers/usb/musb/musb_gadget_ep0.c |
| @@ -114,15 +114,19 @@ static int service_tx_status_request( |
| } |
| |
| is_in = epnum & USB_DIR_IN; |
| - if (is_in) { |
| - epnum &= 0x0f; |
| + epnum &= 0x0f; |
| + if (epnum >= MUSB_C_NUM_EPS) { |
| + handled = -EINVAL; |
| + break; |
| + } |
| + |
| + if (is_in) |
| ep = &musb->endpoints[epnum].ep_in; |
| - } else { |
| + else |
| ep = &musb->endpoints[epnum].ep_out; |
| - } |
| regs = musb->endpoints[epnum].regs; |
| |
| - if (epnum >= MUSB_C_NUM_EPS || !ep->desc) { |
| + if (!ep->desc) { |
| handled = -EINVAL; |
| break; |
| } |
