Commit d92e6991 authored by Colin Ian King's avatar Colin Ian King Committed by Greg Kroah-Hartman

staging: most: usb: sanity check channel before using it as an index into arrays

Currently channel is being sanity checked after it has been used as
an index into some arrays. Fix this by moving the sanity check of
channel before the arrays are indexed with it.

Addresses-Coverity: ("Negative array index read")
Fixes: 59ed0480 ("Staging: most: replace pr_*() functions by dev_*()")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200507150652.52238-1-colin.king@canonical.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 08e1b427
...@@ -664,11 +664,6 @@ static int hdm_configure_channel(struct most_interface *iface, int channel, ...@@ -664,11 +664,6 @@ static int hdm_configure_channel(struct most_interface *iface, int channel,
struct most_dev *mdev = to_mdev(iface); struct most_dev *mdev = to_mdev(iface);
struct device *dev = &mdev->usb_device->dev; struct device *dev = &mdev->usb_device->dev;
mdev->is_channel_healthy[channel] = true;
mdev->clear_work[channel].channel = channel;
mdev->clear_work[channel].mdev = mdev;
INIT_WORK(&mdev->clear_work[channel].ws, wq_clear_halt);
if (!conf) { if (!conf) {
dev_err(dev, "Bad config pointer.\n"); dev_err(dev, "Bad config pointer.\n");
return -EINVAL; return -EINVAL;
...@@ -677,6 +672,12 @@ static int hdm_configure_channel(struct most_interface *iface, int channel, ...@@ -677,6 +672,12 @@ static int hdm_configure_channel(struct most_interface *iface, int channel,
dev_err(dev, "Channel ID out of range.\n"); dev_err(dev, "Channel ID out of range.\n");
return -EINVAL; return -EINVAL;
} }
mdev->is_channel_healthy[channel] = true;
mdev->clear_work[channel].channel = channel;
mdev->clear_work[channel].mdev = mdev;
INIT_WORK(&mdev->clear_work[channel].ws, wq_clear_halt);
if (!conf->num_buffers || !conf->buffer_size) { if (!conf->num_buffers || !conf->buffer_size) {
dev_err(dev, "Misconfig: buffer size or #buffers zero.\n"); dev_err(dev, "Misconfig: buffer size or #buffers zero.\n");
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment