lkml.org 
[lkml]   [2024]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v13 02/53] xhci: fix off by one check when adding a secondary interrupter.
    Date
    From: Mathias Nyman <mathias.nyman@linux.intel.com>

    The sanity check of interrupter index when adding a new interrupter is
    off by one. intr_num needs to be smaller than xhci->max_interrupter to
    fit the array of interrupters.

    Luckily this doesn't cause any real word harm as xhci_add_interrupter()
    is always called with a intr_num value smaller than xhci->max_interrupters
    in any current kernel.

    Should not be needed for stable as 6.7 kernel and older only supports
    one interrupter, with intr_num always being zero.

    Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
    Closes: https://lore.kernel.org/linux-usb/e9771296-586d-456a-ac24-a82de79bb2e6@moroto.mountain/
    Fixes: 4bf398e15aa4 ("xhci: split allocate interrupter into separate alloacte and add parts")
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Link: https://lore.kernel.org/r/20240125152737.2983959-3-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
    ---
    drivers/usb/host/xhci-mem.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
    index d00d4d937236..a7716202a8dd 100644
    --- a/drivers/usb/host/xhci-mem.c
    +++ b/drivers/usb/host/xhci-mem.c
    @@ -2322,7 +2322,7 @@ xhci_add_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir,
    u64 erst_base;
    u32 erst_size;

    - if (intr_num > xhci->max_interrupters) {
    + if (intr_num >= xhci->max_interrupters) {
    xhci_warn(xhci, "Can't add interrupter %d, max interrupters %d\n",
    intr_num, xhci->max_interrupters);
    return -EINVAL;
    \
     
     \ /
      Last update: 2024-05-27 14:47    [W:4.573 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site