Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00ee7a37 authored by Octavian Purdila's avatar Octavian Purdila Committed by Lee Jones
Browse files

mfd: dln2: Add a limit check for invalid echo 



The echo field in dln2_transfer_complete comes directly from an USB
transfer and we should not trust it is valid.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarOctavian Purdila <octavian.purdila@intel.com>
Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
parent 93316428

drivers/mfd/dln2.c

+4 −0
Original line number Diff line number Diff line
@@ -195,6 +195,9 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb, 
	struct dln2_rx_context *rxc;

	bool valid_slot = false;



	if (rx_slot >= DLN2_MAX_RX_SLOTS)

		goto out;



	rxc = &rxs->slots[rx_slot];



	/*
@@ -210,6 +213,7 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb, 
	}

	spin_unlock(&rxs->lock);



out:

	if (!valid_slot)

		dev_warn(dev, "bad/late response %d/%d\n", handle, rx_slot);