Skip to contentSkip to conversation

wusb: fix find_first_zero_bit() return value check

PATCH New Akinobu Mita 1 participant 1 message Mar 2, 2011 USB

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 wusb: fix find_first_zero_bit() return value check

In wusb_cluster_id_get(), if no zero bits exist in wusb_cluster_id_table, find_first_zero_bit() returns CLUSTER_IDS.

But it is impossible to detect that the bitmap is full because there is an off-by-one error in the return value check. It will cause unexpected memory access by setting bit out of wusb_cluster_id_table bitmap, and caller will get wrong cluster id.

---
 drivers/usb/wusbcore/wusbhc.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/usb/wusbcore/wusbhc.c +1 -1
index 2054d4e..0faca16 100644
@@ -320,7 +320,7 @@ u8 wusb_cluster_id_get(void)
 	u8 id;
 	spin_lock(&wusb_cluster_ids_lock);
 	id = find_first_zero_bit(wusb_cluster_id_table, CLUSTER_IDS);
-	if (id > CLUSTER_IDS) {
+	if (id >= CLUSTER_IDS) {
 		id = 0;
 		goto out;
 	}
Signature · 1 line
1.7.4