From: Oleksij Rempel <linux@rempel-privat.de>
To: barebox@lists.infradead.org
Cc: Oleksij Rempel <linux@rempel-privat.de>
Subject: [PATCH v1 8/9] usb: musb: fix possible out of bounds access
Date: Tue, 20 Nov 2018 21:07:13 +0100 [thread overview]
Message-ID: <20181120200714.3692-9-linux@rempel-privat.de> (raw)
In-Reply-To: <20181120200714.3692-1-linux@rempel-privat.de>
Either the condition 'epnum>=((u8)16)' is redundant or the array
'musb->endpoints[16]' is accessed at index 16, which is out of bounds.
Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
---
drivers/usb/musb/musb_gadget_ep0.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index feaa85645..c8f55ac32 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -110,6 +110,11 @@ static int service_tx_status_request(
break;
}
+ if (epnum >= MUSB_C_NUM_EPS) {
+ handled = -EINVAL;
+ break;
+ }
+
is_in = epnum & USB_DIR_IN;
if (is_in) {
epnum &= 0x0f;
@@ -119,7 +124,7 @@ static int service_tx_status_request(
}
regs = musb->endpoints[epnum].regs;
- if (epnum >= MUSB_C_NUM_EPS || !ep->desc) {
+ if (!ep->desc) {
handled = -EINVAL;
break;
}
--
2.17.1
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
next prev parent reply other threads:[~2018-11-20 20:07 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-20 20:07 [PATCH v1 0/9] random fixes Oleksij Rempel
2018-11-20 20:07 ` [PATCH v1 1/9] net: e1000: fix "Uninitialized variable: phy_data" warning Oleksij Rempel
2018-11-20 20:07 ` [PATCH v1 2/9] pinctrl: tegra30: fix "Possible null pointer dereference: group" warning Oleksij Rempel
2018-11-21 9:16 ` Lucas Stach
2018-11-21 9:40 ` Oleksij Rempel
2018-11-21 10:01 ` Lucas Stach
2018-11-20 20:07 ` [PATCH v1 3/9] fs: closedir: remove uninitialized variable ret Oleksij Rempel
2018-11-20 20:07 ` [PATCH v1 4/9] fs: fix possible null pointer dereference of base Oleksij Rempel
2018-11-20 20:07 ` [PATCH v1 5/9] mfd: da9063: fix wrong NULL pointer test Oleksij Rempel
2018-11-20 20:07 ` [PATCH v1 6/9] usb: at91_udc: remove useless NULL check Oleksij Rempel
2018-11-20 20:07 ` [PATCH v1 7/9] mtd: atmel_nand: remove erroneous case Oleksij Rempel
2018-11-20 20:07 ` Oleksij Rempel [this message]
2018-11-20 20:07 ` [PATCH v1 9/9] lib: lodepng: remove useless test Oleksij Rempel
2018-11-21 8:08 ` [PATCH v1 0/9] random fixes Sascha Hauer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181120200714.3692-9-linux@rempel-privat.de \
--to=linux@rempel-privat.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox