Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1440e096 authored by David Brownell's avatar David Brownell Committed by Greg Kroah-Hartman
Browse files

USB: gadget: at91_udc minor fix (there is no number six) 



Fix a small glitch noted by Yannick Cote.  There is no endpoint number
six, so if a (broken) host wrongly tried to change or read status of
that endpoint, the driver could access reserved register space.

Signed-off-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Cc: Yannick Cote <yanick@yanos.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent e5867980

drivers/usb/gadget/at91_udc.c

+3 −3
Original line number Diff line number Diff line
@@ -1153,7 +1153,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) 
			| USB_REQ_GET_STATUS:

		tmp = w_index & USB_ENDPOINT_NUMBER_MASK;

		ep = &udc->ep[tmp];

		if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc))

		if (tmp >= NUM_ENDPOINTS || (tmp && !ep->desc))

			goto stall;



		if (tmp) {
@@ -1176,7 +1176,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) 
			| USB_REQ_SET_FEATURE:

		tmp = w_index & USB_ENDPOINT_NUMBER_MASK;

		ep = &udc->ep[tmp];

		if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)

		if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)

			goto stall;

		if (!ep->desc || ep->is_iso)

			goto stall;
@@ -1195,7 +1195,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) 
			| USB_REQ_CLEAR_FEATURE:

		tmp = w_index & USB_ENDPOINT_NUMBER_MASK;

		ep = &udc->ep[tmp];

		if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)

		if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)

			goto stall;

		if (tmp == 0)

			goto succeed;