Re: [PATCH] usb: dwc2: Fix crash in incomplete isoc intr handlers.

[Minas Harutyunyan]

On 5/5/2018 12:30 PM, Artur Petrosyan wrote:
> Crash caused by going out of "eps_out" array range.
> Iteration on "eps_out" changed to less than "num_of_eps".
> 
> Signed-off-by: Artur Petrosyan 
> ---
Acked-by: Minas Harutyunyan 

>   drivers/usb/dwc2/gadget.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
> index 6c32bf26e48e..010cfbca962a 100644
> --- a/drivers/usb/dwc2/gadget.c
> +++ b/drivers/usb/dwc2/gadget.c
> @@ -3427,7 +3427,7 @@ static void 
> dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg)
>   
>   daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);
>   
> - for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
> + for (idx = 1; idx < hsotg->num_of_eps; idx++) {
>   hs_ep = hsotg->eps_in[idx];
>   /* Proceed only unmasked ISOC EPs */
>   if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
> @@ -3473,7 +3473,7 @@ static void 
> dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg)
>   daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);
>   daintmsk >>= DAINT_OUTEP_SHIFT;
>   
> - for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
> + for (idx = 1; idx < hsotg->num_of_eps; idx++) {
>   hs_ep = hsotg->eps_out[idx];
>   /* Proceed only unmasked ISOC EPs */
>   if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
> @@ -3647,7 +3647,7 @@ static irqreturn_t dwc2_hsotg_irq(int irq, void *pw)
>   dwc2_writel(gintmsk, hsotg->regs + GINTMSK);
>   
>   dev_dbg(hsotg->dev, "GOUTNakEff triggered\n");
> - for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
> + for (idx = 1; idx < hsotg->num_of_eps; idx++) {
>   hs_ep = hsotg->eps_out[idx];
>   /* Proceed only unmasked ISOC EPs */
>   if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH] usb: dwc2: Fix crash in incomplete isoc intr handlers.

[Artur Petrosyan]

Crash caused by going out of "eps_out" array range.
Iteration on "eps_out" changed to less than "num_of_eps".

Signed-off-by: Artur Petrosyan 
---
 drivers/usb/dwc2/gadget.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 6c32bf26e48e..010cfbca962a 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3427,7 +3427,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct 
dwc2_hsotg *hsotg)
 
daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);
 
-   for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
+   for (idx = 1; idx < hsotg->num_of_eps; idx++) {
hs_ep = hsotg->eps_in[idx];
/* Proceed only unmasked ISOC EPs */
if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
@@ -3473,7 +3473,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct 
dwc2_hsotg *hsotg)
daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);
daintmsk >>= DAINT_OUTEP_SHIFT;
 
-   for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
+   for (idx = 1; idx < hsotg->num_of_eps; idx++) {
hs_ep = hsotg->eps_out[idx];
/* Proceed only unmasked ISOC EPs */
if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
@@ -3647,7 +3647,7 @@ static irqreturn_t dwc2_hsotg_irq(int irq, void *pw)
dwc2_writel(gintmsk, hsotg->regs + GINTMSK);
 
dev_dbg(hsotg->dev, "GOUTNakEff triggered\n");
-   for (idx = 1; idx <= hsotg->num_of_eps; idx++) {
+   for (idx = 1; idx < hsotg->num_of_eps; idx++) {
hs_ep = hsotg->eps_out[idx];
/* Proceed only unmasked ISOC EPs */
if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
-- 
2.11.0

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html