From: Xenia Ragiadakou <[email protected]> The fields 'add_flags' and 'drop_flags' in struct xhci_input_control_ctx have type __le32 and need to be converted to CPU byteorder before being used to derive the number of dropped endpoints. This bug was found using sparse.
This patch is not suitable for stable, since the bug would only be triggered on big endian systems, and the code only runs for Intel xHCI host controllers, which are always integrated into little endian systems. Signed-off-by: Xenia Ragiadakou <[email protected]> Signed-off-by: Sarah Sharp <[email protected]> --- drivers/usb/host/xhci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index b7289e9a44dd..900ba36ee2b8 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1909,8 +1909,8 @@ static unsigned int xhci_count_num_dropped_endpoints(struct xhci_hcd *xhci, u32 valid_add_flags; u32 valid_drop_flags; - valid_add_flags = ctrl_ctx->add_flags >> 2; - valid_drop_flags = ctrl_ctx->drop_flags >> 2; + valid_add_flags = le32_to_cpu(ctrl_ctx->add_flags) >> 2; + valid_drop_flags = le32_to_cpu(ctrl_ctx->drop_flags) >> 2; return hweight32(valid_drop_flags) - hweight32(valid_add_flags & valid_drop_flags); -- 1.8.3.3 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
