Fix a small glitch noted by Yannick Cote. There is no endpoint number
six, so if a (broken) host wrongly tried to change or read status of
that endpoint, the driver could access reserved register space.
Signed-off-by: David Brownell <[EMAIL PROTECTED]>
Cc: Yannick Cote <[EMAIL PROTECTED]>
---
drivers/usb/gadget/at91_udc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- at91.orig/drivers/usb/gadget/at91_udc.c 2007-12-09 22:34:13.000000000
-0800
+++ at91/drivers/usb/gadget/at91_udc.c 2007-12-09 22:34:37.000000000 -0800
@@ -1151,7 +1151,7 @@ static void handle_setup(struct at91_udc
| USB_REQ_GET_STATUS:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc))
+ if (tmp >= NUM_ENDPOINTS || (tmp && !ep->desc))
goto stall;
if (tmp) {
@@ -1174,7 +1174,7 @@ static void handle_setup(struct at91_udc
| USB_REQ_SET_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
+ if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall;
if (!ep->desc || ep->is_iso)
goto stall;
@@ -1193,7 +1193,7 @@ static void handle_setup(struct at91_udc
| USB_REQ_CLEAR_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
+ if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall;
if (tmp == 0)
goto succeed;
-
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
