diff options
| author | Andrew Goodbody <[email protected]> | 2025-09-30 16:52:23 +0100 |
|---|---|---|
| committer | Marek Vasut <[email protected]> | 2025-10-28 16:35:05 +0100 |
| commit | d5de67c57e795325a67ec4ca6486654b72ade038 (patch) | |
| tree | 24be38fce9dbf01a2f671321e58ee2120b6cd271 /drivers | |
| parent | 6ea91bf8055b18b24828c449e33572ca9a9832eb (diff) | |
usb: musb-new: Limit check array index before use
epnum is used as an index into an array. The limit check for this index
should be performed before using it to access an element in the array to
prevent possible bounds overrun.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <[email protected]>
Reviewed-by: Mattijs Korpershoek <[email protected]>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/musb-new/musb_gadget_ep0.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/usb/musb-new/musb_gadget_ep0.c b/drivers/usb/musb-new/musb_gadget_ep0.c index ea65326ab62..25b1de6e58f 100644 --- a/drivers/usb/musb-new/musb_gadget_ep0.c +++ b/drivers/usb/musb-new/musb_gadget_ep0.c @@ -96,6 +96,9 @@ static int service_tx_status_request( if (!epnum) { result[0] = 0; break; + } else if (epnum >= MUSB_C_NUM_EPS) { + handled = -EINVAL; + break; } is_in = epnum & USB_DIR_IN; @@ -107,7 +110,7 @@ static int service_tx_status_request( } regs = musb->endpoints[epnum].regs; - if (epnum >= MUSB_C_NUM_EPS || !ep->desc) { + if (!ep->desc) { handled = -EINVAL; break; } |