iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mfd: dln2: Add a limit check for invalid echo

Browse Source 
The echo field in dln2_transfer_complete comes directly from an USB
transfer and we should not trust it is valid.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
This commit is contained in:
Octavian Purdila 2014-11-18 14:57:59 +02:00 committed by Lee Jones
parent 9331642812
commit 00ee7a37fd
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/mfd/dln2.c
View File

@ -195,6 +195,9 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb,
struct dln2_rx_context *rxc; struct dln2_rx_context *rxc;
bool valid_slot = false; bool valid_slot = false;
if (rx_slot >= DLN2_MAX_RX_SLOTS)
goto out;
rxc = &rxs->slots[rx_slot]; rxc = &rxs->slots[rx_slot];
/* /*
@ -210,6 +213,7 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb,
} }
spin_unlock(&rxs->lock); spin_unlock(&rxs->lock);
out:
if (!valid_slot) if (!valid_slot)
dev_warn(dev, "bad/late response %d/%d\n", handle, rx_slot); dev_warn(dev, "bad/late response %d/%d\n", handle, rx_slot);