A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: dwc3-msm: Fix potential array out-of- bounds access

Browse source 
Ensure bus_vote_values and mdwc->dbm_ep_num_mapping use indices
within range.

Change-Id: I9f02bfc416629ada0ed46cabb3931c6f7b0977aa
Signed-off-by: Ronak Vijay Raheja <rraheja@codeaurora.org>
This commit is contained in:
Ronak Vijay Raheja 2020-06-12 12:43:59 -07:00
commit a16e3c530d
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/usb/dwc3/dwc3-msm.c
View file

@ -758,6 +758,11 @@ int msm_data_fifo_config(struct usb_ep *ep, unsigned long addr,
dev_dbg(mdwc->dev, "%s\n", __func__);
if (dbm_ep >= DBM_1_5_NUM_EP) {
dev_err(mdwc->dev, "Invalid DBM EP num:%d\n", dbm_ep);
return -EINVAL;
}
mdwc->dbm_ep_num_mapping[dbm_ep] = dep->number;
if (!mdwc->dbm_is_1p4 || sizeof(addr) > sizeof(u32)) {
@ -4254,6 +4259,11 @@ static int dwc3_msm_probe(struct platform_device *pdev)
ret = of_property_read_u32(node, "qcom,default-bus-vote",
&mdwc->default_bus_vote);
if (mdwc->default_bus_vote >= BUS_VOTE_MAX)
mdwc->default_bus_vote = BUS_VOTE_MAX - 1;
else if (mdwc->default_bus_vote < BUS_VOTE_NONE)
mdwc->default_bus_vote = BUS_VOTE_NONE;
for (i = 0; i < ARRAY_SIZE(mdwc->icc_paths); i++) {
mdwc->icc_paths[i] = of_icc_get(&pdev->dev, icc_path_names[i]);
if (IS_ERR(mdwc->icc_paths[i]))