Commit 1440e096 authored by David Brownell's avatar David Brownell Committed by Greg Kroah-Hartman

USB: gadget: at91_udc minor fix (there is no number six)

Fix a small glitch noted by Yannick Cote.  There is no endpoint number
six, so if a (broken) host wrongly tried to change or read status of
that endpoint, the driver could access reserved register space.
Signed-off-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Cc: Yannick Cote <yanick@yanos.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent e5867980
...@@ -1153,7 +1153,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) ...@@ -1153,7 +1153,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
| USB_REQ_GET_STATUS: | USB_REQ_GET_STATUS:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK; tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp]; ep = &udc->ep[tmp];
if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc)) if (tmp >= NUM_ENDPOINTS || (tmp && !ep->desc))
goto stall; goto stall;
if (tmp) { if (tmp) {
...@@ -1176,7 +1176,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) ...@@ -1176,7 +1176,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
| USB_REQ_SET_FEATURE: | USB_REQ_SET_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK; tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp]; ep = &udc->ep[tmp];
if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS) if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall; goto stall;
if (!ep->desc || ep->is_iso) if (!ep->desc || ep->is_iso)
goto stall; goto stall;
...@@ -1195,7 +1195,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) ...@@ -1195,7 +1195,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
| USB_REQ_CLEAR_FEATURE: | USB_REQ_CLEAR_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK; tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp]; ep = &udc->ep[tmp];
if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS) if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall; goto stall;
if (tmp == 0) if (tmp == 0)
goto succeed; goto succeed;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment