From a16e3c530d4488e8acddaf0f3ff96fbca99c60cc Mon Sep 17 00:00:00 2001 From: Ronak Vijay Raheja Date: Fri, 12 Jun 2020 12:43:59 -0700 Subject: [PATCH] usb: dwc3-msm: Fix potential array out-of- bounds access Ensure bus_vote_values and mdwc->dbm_ep_num_mapping use indices within range. Change-Id: I9f02bfc416629ada0ed46cabb3931c6f7b0977aa Signed-off-by: Ronak Vijay Raheja --- drivers/usb/dwc3/dwc3-msm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/usb/dwc3/dwc3-msm.c b/drivers/usb/dwc3/dwc3-msm.c index 2993583aa9dc..60e12d6c18b7 100644 --- a/drivers/usb/dwc3/dwc3-msm.c +++ b/drivers/usb/dwc3/dwc3-msm.c @@ -758,6 +758,11 @@ int msm_data_fifo_config(struct usb_ep *ep, unsigned long addr, dev_dbg(mdwc->dev, "%s\n", __func__); + if (dbm_ep >= DBM_1_5_NUM_EP) { + dev_err(mdwc->dev, "Invalid DBM EP num:%d\n", dbm_ep); + return -EINVAL; + } + mdwc->dbm_ep_num_mapping[dbm_ep] = dep->number; if (!mdwc->dbm_is_1p4 || sizeof(addr) > sizeof(u32)) { @@ -4254,6 +4259,11 @@ static int dwc3_msm_probe(struct platform_device *pdev) ret = of_property_read_u32(node, "qcom,default-bus-vote", &mdwc->default_bus_vote); + if (mdwc->default_bus_vote >= BUS_VOTE_MAX) + mdwc->default_bus_vote = BUS_VOTE_MAX - 1; + else if (mdwc->default_bus_vote < BUS_VOTE_NONE) + mdwc->default_bus_vote = BUS_VOTE_NONE; + for (i = 0; i < ARRAY_SIZE(mdwc->icc_paths); i++) { mdwc->icc_paths[i] = of_icc_get(&pdev->dev, icc_path_names[i]); if (IS_ERR(mdwc->icc_paths[i]))