2013/12/16 David Laight <[email protected]>: >> From: Of Wang, Lin X >> Sent: 15 December 2013 14:21 >> To: Sarah Sharp ([email protected]) >> Cc: [email protected] >> Subject: [PATCH] xhci: fix array index out of the bounds in function >> last_trb() and >> last_trb_on_last_seg() >> >> In function last_trb() and last_trb_on_last_seg(), incorrect array index >> value 'TRBS_PER_SEGMENT' is >> used to determine the last element in an event ring segment, which lead to >> the out-of-bounds >> of index. But according to the current logic of event ring operation, this >> "bug" brings no problems >> and the driver works as desired. This patch only fix this array index >> out-of-bounds issue and there is >> no need no modify corresponding ring operation. >> >> Signed-off-by: Lin Wang <[email protected]> >> --- >> drivers/usb/host/xhci-ring.c | 10 +++++----- >> 1 file changed, 5 insertions(+), 5 deletions(-) >> >> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c >> index d26cd94..3f93b07 100644 >> --- a/drivers/usb/host/xhci-ring.c >> +++ b/drivers/usb/host/xhci-ring.c >> @@ -98,21 +98,21 @@ static bool last_trb_on_last_seg(struct xhci_hcd *xhci, >> struct xhci_ring *ring, >> struct xhci_segment *seg, union xhci_trb *trb) >> { >> if (ring == xhci->event_ring) >> - return (trb == &seg->trbs[TRBS_PER_SEGMENT]) && >> + return (trb == &seg->trbs[TRBS_PER_SEGMENT - 1]) && > > Taking the address of the element beyond the end of an array is valid C.
It's vaild in C doesn't mean that it‘s reasonable, besides, 'TRBS_PER_SEGMENT - 1' is widely used in current implementation to identily the last element in an array, using 'TRBS_PER_SEGMENT' here result in a lack of unity in style and easy to get lost. > So there is nothing wrong with this code. > Apply the patch and the last event written by the hardware won't be processed. The only function affected here is inc_deq(), and i did not find trb skipped by H/W, please let me know if i missed something. Thanks！ Lin > > David > > > -- > To unsubscribe from this list: send the line "unsubscribe linux-usb" in > the body of a message to [email protected] > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
