Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d66b6f5 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "USB: dwc3: debugfs: Add boundary check in dwc3_store_ep_num()"

parents 02d24ecf de81d402

drivers/usb/dwc3/debugfs.c

+10 −2
Original line number Diff line number Diff line
@@ -630,7 +630,7 @@ static ssize_t dwc3_store_ep_num(struct file *file, const char __user *ubuf, 
	struct seq_file		*s = file->private_data;

	struct dwc3		*dwc = s->private;

	char			kbuf[10];

	unsigned int		num, dir;

	unsigned int		num, dir, temp;

	unsigned long		flags;



	memset(kbuf, 0, 10);
@@ -641,8 +641,16 @@ static ssize_t dwc3_store_ep_num(struct file *file, const char __user *ubuf, 
	if (sscanf(kbuf, "%u %u", &num, &dir) != 2)

		return -EINVAL;



	if (dir != 0 && dir != 1)

		return -EINVAL;



	temp = (num << 1) + dir;

	if (temp >= (dwc->num_in_eps + dwc->num_out_eps) ||

					temp >= DWC3_ENDPOINTS_NUM)

		return -EINVAL;



	spin_lock_irqsave(&dwc->lock, flags);

	ep_num = (num << 1) + dir;

	ep_num = temp;

	spin_unlock_irqrestore(&dwc->lock, flags);



	return count;