duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

usb: host: xhci: Fix bound check for interrupter number

Browse Source 
Since max_interrupters flag includes primary interrupter as well,
update the bound check when this flag is being used for
secondary event ring clean-up/allocation.

Change-Id: I044c5a89fe17779eb847981cbf27e99b97e37d80
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
This commit is contained in:
Hemant Kumar committed 2018-11-12 14:41:19 -08:00
1 parent a1504b40da
commit a7e7dd8a34
2 files changed
+5 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

drivers/usb/host/xhci-mem.c
+3 -3
View File
@@ -1912,7 +1912,7 @@ int xhci_sec_event_ring_cleanup(struct usb_hcd *hcd, unsigned int intr_num)
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
if (intr_num > xhci->max_interrupters) {
if (intr_num >= xhci->max_interrupters) {
xhci_err(xhci, "invalid secondary interrupter num %d\n",
intr_num);
return -EINVAL;
@@ -1943,7 +1943,7 @@ void xhci_event_ring_cleanup(struct xhci_hcd *xhci)
unsigned int i;
/* sec event ring clean up */
for (i = 1; i <= xhci->max_interrupters; i++)
for (i = 1; i < xhci->max_interrupters; i++)
xhci_sec_event_ring_cleanup(xhci_to_hcd(xhci), i);
kfree(xhci->sec_ir_set);
@@ -2535,7 +2535,7 @@ int xhci_sec_event_ring_setup(struct usb_hcd *hcd, unsigned int intr_num)
if ((xhci->xhc_state & XHCI_STATE_HALTED) || !xhci->sec_ir_set
|| !xhci->sec_event_ring || !xhci->sec_erst ||
intr_num > xhci->max_interrupters) {
intr_num >= xhci->max_interrupters) {
xhci_err(xhci,
"%s:state %x ir_set %pK evt_ring %pK erst %pK intr# %d\n",
__func__, xhci->xhc_state, xhci->sec_ir_set,
drivers/usb/host/xhci.c
+2 -2
View File
@@ -5114,8 +5114,8 @@ dma_addr_t xhci_get_sec_event_ring_dma_addr(struct usb_hcd *hcd,
{
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
if (intr_num > xhci->max_interrupters) {
xhci_err(xhci, "intr num %d > max intrs %d\n", intr_num,
if (intr_num >= xhci->max_interrupters) {
xhci_err(xhci, "intr num %d >= max intrs %d\n", intr_num,
xhci->max_interrupters);
return 0;
}