Skip to contentSkip to conversation

usb: gadget: fsl_qe_udc: off by one in setup_received_handle()

PATCH In review Dan Carpenter 2 participants 2 messages Jul 13, 2016 – Jul 15, 2016

Subsystems (3)
USB Kernel janitors Freescale USB peripheral drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 usb: gadget: fsl_qe_udc: off by one in setup_received_handle()

The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.

Fixes 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')
Signed-off-by Dan Carpenter <[email protected]>
drivers/usb/gadget/udc/fsl_qe_udc.c +1 -1
index 93d28cb..cf8819a 100644
@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
 			struct qe_ep *ep;
 
 			if (wValue != 0 || wLength != 0
-				|| pipe > USB_MAX_ENDPOINTS)
+				|| pipe >= USB_MAX_ENDPOINTS)
 				break;
 			ep = &udc->eps[pipe];
Acked-by on v1 1/1
#1 lore raw
Quoted 10 lines · Dan Carpenter

The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.

Fixes 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')
Signed-off-by Dan Carpenter <[email protected]>
drivers/usb/gadget/udc/fsl_qe_udc.c +0 -0
index 93d28cb..cf8819a 100644

drivers/usb/gadget/udc/fsl_qe_udc.c static void setup_received_handle(struct qe_udc *udc, · line 2059

Quoted 8 lines
drivers/usb/gadget/udc/fsl_qe_udc.c +1 -1
@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
 			struct qe_ep *ep;
 
 			if (wValue != 0 || wLength != 0
-				|| pipe > USB_MAX_ENDPOINTS)
+				|| pipe >= USB_MAX_ENDPOINTS)
 				break;
 			ep = &udc->eps[pipe];
Acked-by Peter Chen <[email protected]>
Signature · 2 lines
Best Regards,
Peter Chen