| Message ID | 9398128bddf097e069788aed8bb3d03d3332571a.1525508898.git.arturp@synopsys.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 5/5/2018 12:30 PM, Artur Petrosyan wrote: > Crash caused by going out of "eps_out" array range. > Iteration on "eps_out" changed to less than "num_of_eps". > > Signed-off-by: Artur Petrosyan <arturp@synopsys.com> > --- Acked-by: Minas Harutyunyan <hminas@synopsys.com> > drivers/usb/dwc2/gadget.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c > index 6c32bf26e48e..010cfbca962a 100644 > --- a/drivers/usb/dwc2/gadget.c > +++ b/drivers/usb/dwc2/gadget.c > @@ -3427,7 +3427,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg) > > daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); > > - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { > + for (idx = 1; idx < hsotg->num_of_eps; idx++) { > hs_ep = hsotg->eps_in[idx]; > /* Proceed only unmasked ISOC EPs */ > if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) > @@ -3473,7 +3473,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg) > daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); > daintmsk >>= DAINT_OUTEP_SHIFT; > > - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { > + for (idx = 1; idx < hsotg->num_of_eps; idx++) { > hs_ep = hsotg->eps_out[idx]; > /* Proceed only unmasked ISOC EPs */ > if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) > @@ -3647,7 +3647,7 @@ static irqreturn_t dwc2_hsotg_irq(int irq, void *pw) > dwc2_writel(gintmsk, hsotg->regs + GINTMSK); > > dev_dbg(hsotg->dev, "GOUTNakEff triggered\n"); > - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { > + for (idx = 1; idx < hsotg->num_of_eps; idx++) { > hs_ep = hsotg->eps_out[idx]; > /* Proceed only unmasked ISOC EPs */ > if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) > -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c index 6c32bf26e48e..010cfbca962a 100644 --- a/drivers/usb/dwc2/gadget.c +++ b/drivers/usb/dwc2/gadget.c @@ -3427,7 +3427,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg) daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { + for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_in[idx]; /* Proceed only unmasked ISOC EPs */ if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) @@ -3473,7 +3473,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg) daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); daintmsk >>= DAINT_OUTEP_SHIFT; - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { + for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_out[idx]; /* Proceed only unmasked ISOC EPs */ if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) @@ -3647,7 +3647,7 @@ static irqreturn_t dwc2_hsotg_irq(int irq, void *pw) dwc2_writel(gintmsk, hsotg->regs + GINTMSK); dev_dbg(hsotg->dev, "GOUTNakEff triggered\n"); - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { + for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_out[idx]; /* Proceed only unmasked ISOC EPs */ if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
Crash caused by going out of "eps_out" array range. Iteration on "eps_out" changed to less than "num_of_eps". Signed-off-by: Artur Petrosyan <arturp@synopsys.com> --- drivers/usb/dwc2/gadget.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)