From a31105b8d113bb3f258078156bc3f73e7903d484 Mon Sep 17 00:00:00 2001 From: Daniel J Blueman Date: Mon, 4 Jul 2016 15:53:42 +0800 Subject: [PATCH] Prevent out-of-bounds array access Signed-off-by: Daniel J Blueman --- drivers/usb/host/ehci-hub.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c index ffc9029..5ecfc50 100644 --- a/drivers/usb/host/ehci-hub.c +++ b/drivers/usb/host/ehci-hub.c @@ -872,14 +872,25 @@ int ehci_hub_control( ) { struct ehci_hcd *ehci = hcd_to_ehci (hcd); int ports = HCS_N_PORTS (ehci->hcs_params); - u32 __iomem *status_reg = &ehci->regs->port_status[ - (wIndex & 0xff) - 1]; - u32 __iomem *hostpc_reg = &ehci->regs->hostpc[(wIndex & 0xff) - 1]; + u32 __iomem *status_reg, *hostpc_reg; u32 temp, temp1, status; unsigned long flags; int retval = 0; unsigned selector; + if (wIndex) { + if (wIndex <= ports) + status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1]; + else + status_reg = NULL; + + if (wIndex < sizeof(&ehci->regs->hostpc) / sizeof(&ehci->regs->hostpc[0])) + hostpc_reg = &ehci->regs->hostpc[(wIndex & 0xff) - 1]; + else + hostpc_reg = NULL; + } else + status_reg = hostpc_reg = NULL; + /* * FIXME: support SetPortFeatures USB_PORT_FEAT_INDICATOR. * HCS_INDICATOR may say we can change LEDs to off/amber/green. -- 2.7.4