diff options
| author | David Brownell <david-b@pacbell.net> | 2007-12-10 07:53:09 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-02-01 23:34:59 +0100 |
| commit | 1440e0967de8c598dae96d741652d498b3eb8f27 (patch) | |
| tree | c00b72257474bbdf10d16f598d7c3e836eba65c6 /drivers/usb/gadget/at91_udc.c | |
| parent | USB: fix NULL pointer dereference on drivers/usb/serial/whiteheat.c (diff) | |
| download | linux-1440e0967de8c598dae96d741652d498b3eb8f27.tar.xz linux-1440e0967de8c598dae96d741652d498b3eb8f27.zip | |
USB: gadget: at91_udc minor fix (there is no number six)
Fix a small glitch noted by Yannick Cote. There is no endpoint number
six, so if a (broken) host wrongly tried to change or read status of
that endpoint, the driver could access reserved register space.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Cc: Yannick Cote <yanick@yanos.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/gadget/at91_udc.c')
| -rw-r--r-- | drivers/usb/gadget/at91_udc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c index 4b6ed353ae36..305db36a3b1c 100644 --- a/drivers/usb/gadget/at91_udc.c +++ b/drivers/usb/gadget/at91_udc.c @@ -1153,7 +1153,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) | USB_REQ_GET_STATUS: tmp = w_index & USB_ENDPOINT_NUMBER_MASK; ep = &udc->ep[tmp]; - if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc)) + if (tmp >= NUM_ENDPOINTS || (tmp && !ep->desc)) goto stall; if (tmp) { @@ -1176,7 +1176,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) | USB_REQ_SET_FEATURE: tmp = w_index & USB_ENDPOINT_NUMBER_MASK; ep = &udc->ep[tmp]; - if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS) + if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS) goto stall; if (!ep->desc || ep->is_iso) goto stall; @@ -1195,7 +1195,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr) | USB_REQ_CLEAR_FEATURE: tmp = w_index & USB_ENDPOINT_NUMBER_MASK; ep = &udc->ep[tmp]; - if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS) + if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS) goto stall; if (tmp == 0) goto succeed; |