Commit 02582b92 authored by Kevin Hilman's avatar Kevin Hilman Committed by Greg Kroah-Hartman

MUSB: Add sanity check for maximum number of endpoints

There is no check if platform code passes in more endpoints (num_eps)
than the maximum number of enpoints (MUSB_C_NUM_EPS.)  The result is
that allocate_instance() happily writes past the end of 'struct musb'
corrupting memory.

This patch adds a BUG() if the platform code requests more than the max.
Signed-off-by: default avatarKevin Hilman <khilman@deeprootsystems.com>
Acked-by: default avatarFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent cede969f
...@@ -1806,6 +1806,7 @@ allocate_instance(struct device *dev, ...@@ -1806,6 +1806,7 @@ allocate_instance(struct device *dev,
musb->ctrl_base = mbase; musb->ctrl_base = mbase;
musb->nIrq = -ENODEV; musb->nIrq = -ENODEV;
musb->config = config; musb->config = config;
BUG_ON(musb->config->num_eps > MUSB_C_NUM_EPS);
for (epnum = 0, ep = musb->endpoints; for (epnum = 0, ep = musb->endpoints;
epnum < musb->config->num_eps; epnum < musb->config->num_eps;
epnum++, ep++) { epnum++, ep++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment