Commit 9933698f authored by Haimin Zhang's avatar Haimin Zhang Committed by Greg Kroah-Hartman
Browse files

USB: ehci_brcm_hub_control: Improve port index sanitizing 



Due to (wIndex & 0xff) - 1 can get an integer greater than 15, this
can cause array index to be out of bounds since the size of array
port_status is 15. This change prevents a possible out-of-bounds
pointer computation by forcing the use of a valid port number.

Reported-by: default avatarTCS Robot <tcs_robot@tencent.com>
Signed-off-by: default avatarHaimin Zhang <tcs.kernel@gmail.com>
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20211113165320.GA59686@rowland.harvard.edu


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4ce3b457

drivers/usb/host/ehci-brcm.c

+5 −1
Original line number Diff line number Diff line
@@ -62,8 +62,12 @@ static int ehci_brcm_hub_control( 
	u32 __iomem	*status_reg;

	unsigned long flags;

	int retval, irq_disabled = 0;

	u32 temp;



	status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];

	temp = (wIndex & 0xff) - 1;

	if (temp >= HCS_N_PORTS_MAX)	/* Avoid index-out-of-bounds warning */

		temp = 0;

	status_reg = &ehci->regs->port_status[temp];



	/*

	 * RESUME is cleared when GetPortStatus() is called 20ms after start