Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a16e3c53 authored by Ronak Vijay Raheja's avatar Ronak Vijay Raheja
Browse files

usb: dwc3-msm: Fix potential array out-of- bounds access 



Ensure bus_vote_values and mdwc->dbm_ep_num_mapping use indices
within range.

Change-Id: I9f02bfc416629ada0ed46cabb3931c6f7b0977aa
Signed-off-by: default avatarRonak Vijay Raheja <rraheja@codeaurora.org>
parent 0a4836e3

drivers/usb/dwc3/dwc3-msm.c

+10 −0
Original line number Diff line number Diff line
@@ -758,6 +758,11 @@ int msm_data_fifo_config(struct usb_ep *ep, unsigned long addr, 


	dev_dbg(mdwc->dev, "%s\n", __func__);



	if (dbm_ep >= DBM_1_5_NUM_EP) {

		dev_err(mdwc->dev, "Invalid DBM EP num:%d\n", dbm_ep);

		return -EINVAL;

	}



	mdwc->dbm_ep_num_mapping[dbm_ep] = dep->number;



	if (!mdwc->dbm_is_1p4 || sizeof(addr) > sizeof(u32)) {
@@ -4254,6 +4259,11 @@ static int dwc3_msm_probe(struct platform_device *pdev) 
	ret = of_property_read_u32(node, "qcom,default-bus-vote",

			&mdwc->default_bus_vote);



	if (mdwc->default_bus_vote >= BUS_VOTE_MAX)

		mdwc->default_bus_vote = BUS_VOTE_MAX - 1;

	else if (mdwc->default_bus_vote < BUS_VOTE_NONE)

		mdwc->default_bus_vote = BUS_VOTE_NONE;



	for (i = 0; i < ARRAY_SIZE(mdwc->icc_paths); i++) {

		mdwc->icc_paths[i] = of_icc_get(&pdev->dev, icc_path_names[i]);

		if (IS_ERR(mdwc->icc_paths[i]))