Commit 2c605b45 authored Jan 28, 2020 by Jack Pham

usb: dwc3-msm: Fix out-of-bounds access in bus voting



The for loop in dwc3_msm_update_bus_bw() was using a NULL
condition rather than against ARRAY_SIZE(mdwc->icc_paths).
This can result in an out-of-bounds access if the memory
just beyond the array also happens to be non-zero.

Change-Id: Ib1f003f774b125a156ceb0070cd9d98a4d1f03ee
Signed-off-by: Jack Pham <jackp@codeaurora.org>

parent 154900b5

drivers/usb/dwc3/dwc3-msm.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2737,7 +2737,7 @@ static int dwc3_msm_update_bus_bw(struct dwc3_msm *mdwc, enum bus_vote bv)
		else if (bv == BUS_VOTE_NONE)
		bv_index = BUS_VOTE_NONE;

		for (i = 0; mdwc->icc_paths[i]; i++) {
		for (i = 0; i < ARRAY_SIZE(mdwc->icc_paths); i++) {
		ret = icc_set_bw(mdwc->icc_paths[i],
		bus_vote_values[bv_index][i].avg,
		bus_vote_values[bv_index][i].peak);