Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfa0b432 authored by Ajay Agarwal's avatar Ajay Agarwal
Browse files

usb: f_serial: Check port_num before allocating serial instance 



Maximum number of allowed gadget serial ports is
GSERIAL_NO_PORTS = 3. There is a chance that we try
to access index >=3 of gser_port array, which is a bug.
Add this check before accessing the gser_port. If
violated, unbind the configuration.

Change-Id: I42cd2847fd2d681b4f8b614048ad54e7fe096092
Signed-off-by: default avatarAjay Agarwal <ajaya@codeaurora.org>
parent 0e9f6197

drivers/usb/gadget/function/f_serial.c

+10 −5
Original line number Diff line number Diff line
@@ -1111,17 +1111,22 @@ static struct usb_function *gser_alloc(struct usb_function_instance *fi) 
	struct f_gser	*gser;

	struct f_serial_opts *opts;



	opts = container_of(fi, struct f_serial_opts, func_inst);

	if (nr_ports) {

		opts->port_num = gser_next_free_port++;

		if (opts->port_num >= GSERIAL_NO_PORTS) {

			pr_err("%s: No serial allowed for port %d\n",

					__func__, opts->port_num);

			return ERR_PTR(-EINVAL);

		}

	}



	/* allocate and initialize one new instance */

	gser = kzalloc(sizeof(*gser), GFP_KERNEL);

	if (!gser)

		return ERR_PTR(-ENOMEM);



	opts = container_of(fi, struct f_serial_opts, func_inst);



	spin_lock_init(&gser->lock);

	if (nr_ports)

		opts->port_num = gser_next_free_port++;



	gser->port_num = opts->port_num;



	gser->port.func.name = "gser";