Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8d3d2d3 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "usb: host: xhci: Fix bound check for interrupter number"

parents dbba2248 4def2670

drivers/usb/host/xhci-mem.c

+3 −3
Original line number Diff line number Diff line
@@ -1870,7 +1870,7 @@ int xhci_sec_event_ring_cleanup(struct usb_hcd *hcd, unsigned intr_num) 
	struct xhci_hcd *xhci = hcd_to_xhci(hcd);

	struct device	*dev = xhci_to_hcd(xhci)->self.controller;



	if (intr_num > xhci->max_interrupters) {

	if (intr_num >= xhci->max_interrupters) {

		xhci_err(xhci, "invalid secondary interrupter num %d\n",

			intr_num);

		return -EINVAL;
@@ -1903,7 +1903,7 @@ void xhci_event_ring_cleanup(struct xhci_hcd *xhci) 
	struct device	*dev = xhci_to_hcd(xhci)->self.controller;



	/* sec event ring clean up */

	for (i = 1; i <= xhci->max_interrupters; i++)

	for (i = 1; i < xhci->max_interrupters; i++)

		xhci_sec_event_ring_cleanup(xhci_to_hcd(xhci), i);



	kfree(xhci->sec_ir_set);
@@ -2552,7 +2552,7 @@ int xhci_sec_event_ring_setup(struct usb_hcd *hcd, unsigned intr_num) 


	if ((xhci->xhc_state & XHCI_STATE_HALTED) || !xhci->sec_ir_set

		|| !xhci->sec_event_ring || !xhci->sec_erst ||

		intr_num > xhci->max_interrupters) {

		intr_num >= xhci->max_interrupters) {

		xhci_err(xhci,

		"%s:state %x ir_set %pK evt_ring %pK erst %pK intr# %d\n",

		__func__, xhci->xhc_state, xhci->sec_ir_set,

drivers/usb/host/xhci.c

+2 −2
Original line number Diff line number Diff line
@@ -4982,8 +4982,8 @@ dma_addr_t xhci_get_sec_event_ring_dma_addr(struct usb_hcd *hcd, 
{

	struct xhci_hcd *xhci = hcd_to_xhci(hcd);



	if (intr_num > xhci->max_interrupters) {

		xhci_err(xhci, "intr num %d > max intrs %d\n", intr_num,

	if (intr_num >= xhci->max_interrupters) {

		xhci_err(xhci, "intr num %d >= max intrs %d\n", intr_num,

			xhci->max_interrupters);

		return 0;

	}