diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-05 16:25:02 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-05 16:25:02 +0200 |
| commit | d8c3916023d438a40cf16b284ee6ae7acab57b64 (patch) | |
| tree | 8028419822118104c7c52017eae1d2d5d18a84dc /drivers | |
| parent | usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interr... (diff) | |
| parent | USB: serial: ti_usb_3410_5052: fix array underflow in completion handler (diff) | |
| download | linux-d8c3916023d438a40cf16b284ee6ae7acab57b64.tar.xz linux-d8c3916023d438a40cf16b284ee6ae7acab57b64.zip | |
Merge tag 'usb-serial-4.19-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus
Johan writes:
USB-serial fixes for v4.19-rc3
Here are two fixes for array-underflow bugs in completion handlers due
to insufficient sanity checks.
All have been in linux-next with no reported issues.
Signed-off-by: Johan Hovold <johan@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/io_ti.h | 2 | ||||
| -rw-r--r-- | drivers/usb/serial/ti_usb_3410_5052.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h index e53c68261017..9bbcee37524e 100644 --- a/drivers/usb/serial/io_ti.h +++ b/drivers/usb/serial/io_ti.h @@ -173,7 +173,7 @@ struct ump_interrupt { } __attribute__((packed)); -#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) +#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) #define TIUMP_INTERRUPT_CODE_LSR 0x03 #define TIUMP_INTERRUPT_CODE_MSR 0x04 diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c index 3010878f7f8e..e3c5832337e0 100644 --- a/drivers/usb/serial/ti_usb_3410_5052.c +++ b/drivers/usb/serial/ti_usb_3410_5052.c @@ -1119,7 +1119,7 @@ static void ti_break(struct tty_struct *tty, int break_state) static int ti_get_port_from_code(unsigned char code) { - return (code >> 4) - 3; + return (code >> 6) & 0x01; } static int ti_get_func_from_code(unsigned char code) |