diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-08-27 11:09:26 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-08-27 11:09:26 +0300 |
| commit | 452d1ea55c3e621dc94ac8b832c5e00feb59aad4 (patch) | |
| tree | a0919e295c988e34bdd860d7e5c3d7dfad34b0ab /drivers/usb | |
| parent | d98a30ccdc839947c9233369744341d1fa54439c (diff) | |
| parent | e5d6a7c6cfae9e714a0e8ff64facd1ac68a784c6 (diff) | |
| download | linux-452d1ea55c3e621dc94ac8b832c5e00feb59aad4.tar.xz | |
Merge tag 'usb-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-next
Peter writes:
Only one patch for improving port index calculation for chipidea driver, no big changes.
* tag 'usb-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb:
usb: chipidea: host: fix port index underflow and UBSAN complains
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/chipidea/host.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c index e86d13c04bdb..bdc3885c0d49 100644 --- a/drivers/usb/chipidea/host.c +++ b/drivers/usb/chipidea/host.c @@ -240,15 +240,18 @@ static int ci_ehci_hub_control( ) { struct ehci_hcd *ehci = hcd_to_ehci(hcd); + unsigned int ports = HCS_N_PORTS(ehci->hcs_params); u32 __iomem *status_reg; - u32 temp; + u32 temp, port_index; unsigned long flags; int retval = 0; bool done = false; struct device *dev = hcd->self.controller; struct ci_hdrc *ci = dev_get_drvdata(dev); - status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1]; + port_index = wIndex & 0xff; + port_index -= (port_index > 0); + status_reg = &ehci->regs->port_status[port_index]; spin_lock_irqsave(&ehci->lock, flags); @@ -260,6 +263,11 @@ static int ci_ehci_hub_control( } if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) { + if (!wIndex || wIndex > ports) { + retval = -EPIPE; + goto done; + } + temp = ehci_readl(ehci, status_reg); if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) { retval = -EPIPE; @@ -288,7 +296,7 @@ static int ci_ehci_hub_control( ehci_writel(ehci, temp, status_reg); } - set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports); + set_bit(port_index, &ehci->suspended_ports); goto done; } |