evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "usb: host: xhci: Fix bound check for interrupter number"

Browse source
This commit is contained in:
Linux Build Service Account 2017-02-09 22:09:22 -08:00 • committed by Gerrit - the friendly Code Review server
commit d8d3d2d37d
2 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/usb/host/xhci-mem.c
View file

@ -1870,7 +1870,7 @@ int xhci_sec_event_ring_cleanup(struct usb_hcd *hcd, unsigned intr_num)
struct xhci_hcd *xhci = hcd_to_xhci(hcd); struct xhci_hcd *xhci = hcd_to_xhci(hcd);
struct device *dev = xhci_to_hcd(xhci)->self.controller; struct device *dev = xhci_to_hcd(xhci)->self.controller;
if (intr_num > xhci->max_interrupters) { if (intr_num >= xhci->max_interrupters) {
xhci_err(xhci, "invalid secondary interrupter num %d\n", xhci_err(xhci, "invalid secondary interrupter num %d\n",
intr_num); intr_num);
return -EINVAL; return -EINVAL;
@ -1903,7 +1903,7 @@ void xhci_event_ring_cleanup(struct xhci_hcd *xhci)
struct device *dev = xhci_to_hcd(xhci)->self.controller; struct device *dev = xhci_to_hcd(xhci)->self.controller;
/* sec event ring clean up */ /* sec event ring clean up */
for (i = 1; i <= xhci->max_interrupters; i++) for (i = 1; i < xhci->max_interrupters; i++)
xhci_sec_event_ring_cleanup(xhci_to_hcd(xhci), i); xhci_sec_event_ring_cleanup(xhci_to_hcd(xhci), i);
kfree(xhci->sec_ir_set); kfree(xhci->sec_ir_set);
@ -2552,7 +2552,7 @@ int xhci_sec_event_ring_setup(struct usb_hcd *hcd, unsigned intr_num)
if ((xhci->xhc_state & XHCI_STATE_HALTED) || !xhci->sec_ir_set if ((xhci->xhc_state & XHCI_STATE_HALTED) || !xhci->sec_ir_set
|| !xhci->sec_event_ring || !xhci->sec_erst || || !xhci->sec_event_ring || !xhci->sec_erst ||
intr_num > xhci->max_interrupters) { intr_num >= xhci->max_interrupters) {
xhci_err(xhci, xhci_err(xhci,
"%s:state %x ir_set %pK evt_ring %pK erst %pK intr# %d\n", "%s:state %x ir_set %pK evt_ring %pK erst %pK intr# %d\n",
__func__, xhci->xhc_state, xhci->sec_ir_set, __func__, xhci->xhc_state, xhci->sec_ir_set,

4
drivers/usb/host/xhci.c
View file

@ -4982,8 +4982,8 @@ dma_addr_t xhci_get_sec_event_ring_dma_addr(struct usb_hcd *hcd,
{ {
struct xhci_hcd *xhci = hcd_to_xhci(hcd); struct xhci_hcd *xhci = hcd_to_xhci(hcd);
if (intr_num > xhci->max_interrupters) { if (intr_num >= xhci->max_interrupters) {
xhci_err(xhci, "intr num %d > max intrs %d\n", intr_num, xhci_err(xhci, "intr num %d >= max intrs %d\n", intr_num,
xhci->max_interrupters); xhci->max_interrupters);
return 0; return 0;
} }