usb: chipidea: host: fix port index underflow and UBSAN complains
If wIndex is 0 (and it often is), these calculations underflow and
UBSAN complains, here resolve this by not decrementing the index when
it is equal to 0, this copies the solution from commit 85e3990bea
("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")
Reported-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com
Signed-off-by: Peter Chen <peter.chen@kernel.org>
This commit is contained in:
Родитель
e4788edc73
Коммит
e5d6a7c6cf
|
@ -240,15 +240,18 @@ static int ci_ehci_hub_control(
|
|||
)
|
||||
{
|
||||
struct ehci_hcd *ehci = hcd_to_ehci(hcd);
|
||||
unsigned int ports = HCS_N_PORTS(ehci->hcs_params);
|
||||
u32 __iomem *status_reg;
|
||||
u32 temp;
|
||||
u32 temp, port_index;
|
||||
unsigned long flags;
|
||||
int retval = 0;
|
||||
bool done = false;
|
||||
struct device *dev = hcd->self.controller;
|
||||
struct ci_hdrc *ci = dev_get_drvdata(dev);
|
||||
|
||||
status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
|
||||
port_index = wIndex & 0xff;
|
||||
port_index -= (port_index > 0);
|
||||
status_reg = &ehci->regs->port_status[port_index];
|
||||
|
||||
spin_lock_irqsave(&ehci->lock, flags);
|
||||
|
||||
|
@ -260,6 +263,11 @@ static int ci_ehci_hub_control(
|
|||
}
|
||||
|
||||
if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
|
||||
if (!wIndex || wIndex > ports) {
|
||||
retval = -EPIPE;
|
||||
goto done;
|
||||
}
|
||||
|
||||
temp = ehci_readl(ehci, status_reg);
|
||||
if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
|
||||
retval = -EPIPE;
|
||||
|
@ -288,7 +296,7 @@ static int ci_ehci_hub_control(
|
|||
ehci_writel(ehci, temp, status_reg);
|
||||
}
|
||||
|
||||
set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
|
||||
set_bit(port_index, &ehci->suspended_ports);
|
||||
goto done;
|
||||
}
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче