diff mbox series

[v5] USB: ehci_brcm_hub_control: Improve port index sanitizing

Message ID 20211113165320.GA59686@rowland.harvard.edu (mailing list archive)
State Accepted
Commit 9933698f6119886c110750e67c10ac66f12b730f
Headers show
Series [v5] USB: ehci_brcm_hub_control: Improve port index sanitizing | expand

Commit Message

Alan Stern Nov. 13, 2021, 4:53 p.m. UTC 
From: Haimin Zhang <tcs.kernel@gmail.com>

Due to (wIndex & 0xff) - 1 can get an integer greater than 15, this
can cause array index to be out of bounds since the size of array
port_status is 15. This change prevents a possible out-of-bounds
pointer computation by forcing the use of a valid port number.

Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs.kernel@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>

---

v5 (Alan Stern):	Changed 0xf in patch description to 15.  Added
			comment explaining why the port index is sanitized.

 drivers/usb/host/ehci-brcm.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
diff mbox series

Patch

Index: usb-devel/drivers/usb/host/ehci-brcm.c
===================================================================
--- usb-devel.orig/drivers/usb/host/ehci-brcm.c
+++ usb-devel/drivers/usb/host/ehci-brcm.c
@@ -62,8 +62,12 @@  static int ehci_brcm_hub_control(
 	u32 __iomem	*status_reg;
 	unsigned long flags;
 	int retval, irq_disabled = 0;
+	u32 temp;
 
-	status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
+	temp = (wIndex & 0xff) - 1;
+	if (temp >= HCS_N_PORTS_MAX)	/* Avoid index-out-of-bounds warning */
+		temp = 0;
+	status_reg = &ehci->regs->port_status[temp];
 
 	/*
 	 * RESUME is cleared when GetPortStatus() is called 20ms after start