wusb: fix find_first_zero_bit() return value check
PATCH 1/1 wusb: fix find_first_zero_bit() return value check
In wusb_cluster_id_get(), if no zero bits exist in wusb_cluster_id_table, find_first_zero_bit() returns CLUSTER_IDS.
But it is impossible to detect that the bitmap is full because there is an off-by-one error in the return value check. It will cause unexpected memory access by setting bit out of wusb_cluster_id_table bitmap, and caller will get wrong cluster id.
Signed-off-by Akinobu Mita <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
--- drivers/usb/wusbcore/wusbhc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
drivers/usb/wusbcore/wusbhc.c +1 -1
@@ -320,7 +320,7 @@ u8 wusb_cluster_id_get(void)u8 id;spin_lock (&wusb_cluster_ids_lock); id =find_first_zero_bit (wusb_cluster_id_table,CLUSTER_IDS ); -if (id >CLUSTER_IDS ) { +if (id >=CLUSTER_IDS ) { id =0 ; goto out; }
Signature · 1 line
1.7.4