TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

usb: chipidea: host: fix port index underflow and UBSAN complains

Browse Source 
[ Upstream commit e5d6a7c6cf ]

If wIndex is 0 (and it often is), these calculations underflow and
UBSAN complains, here resolve this by not decrementing the index when
it is equal to 0, this copies the solution from commit 85e3990bea
("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")

Reported-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com
Signed-off-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Li Jun
2021-06-18 16:28:58 +08:00
committed by Greg Kroah-Hartman
parent 2225a5cd2f
commit 2d3fab9cea
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/usb/chipidea/host.c
+11 -3
View File
@@ -233,18 +233,26 @@ static int ci_ehci_hub_control(
) )
{ {
struct ehci_hcd *ehci = hcd_to_ehci(hcd); struct ehci_hcd *ehci = hcd_to_ehci(hcd);
unsigned int ports = HCS_N_PORTS(ehci->hcs_params);
u32 __iomem *status_reg; u32 __iomem *status_reg;
u32 temp; u32 temp, port_index;
unsigned long flags; unsigned long flags;
int retval = 0; int retval = 0;
struct device *dev = hcd->self.controller; struct device *dev = hcd->self.controller;
struct ci_hdrc *ci = dev_get_drvdata(dev); struct ci_hdrc *ci = dev_get_drvdata(dev);
status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1]; port_index = wIndex & 0xff;
port_index -= (port_index > 0);
status_reg = &ehci->regs->port_status[port_index];
spin_lock_irqsave(&ehci->lock, flags); spin_lock_irqsave(&ehci->lock, flags);
if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) { if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
if (!wIndex || wIndex > ports) {
retval = -EPIPE;
goto done;
}
temp = ehci_readl(ehci, status_reg); temp = ehci_readl(ehci, status_reg);
if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) { if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
retval = -EPIPE; retval = -EPIPE;
@@ -273,7 +281,7 @@ static int ci_ehci_hub_control(
ehci_writel(ehci, temp, status_reg); ehci_writel(ehci, temp, status_reg);
} }
set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports); set_bit(port_index, &ehci->suspended_ports);
goto done; goto done;
} }