未验证 提交 e5d6a7c6 编写于 作者: L Li Jun 提交者: Peter Chen

usb: chipidea: host: fix port index underflow and UBSAN complains

If wIndex is 0 (and it often is), these calculations underflow and
UBSAN complains, here resolve this by not decrementing the index when
it is equal to 0, this copies the solution from commit 85e3990b
("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")
Reported-by: NZhipeng Wang <zhipeng.wang_1@nxp.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.comSigned-off-by: NPeter Chen <peter.chen@kernel.org>
上级 e4788edc
...@@ -240,15 +240,18 @@ static int ci_ehci_hub_control( ...@@ -240,15 +240,18 @@ static int ci_ehci_hub_control(
) )
{ {
struct ehci_hcd *ehci = hcd_to_ehci(hcd); struct ehci_hcd *ehci = hcd_to_ehci(hcd);
unsigned int ports = HCS_N_PORTS(ehci->hcs_params);
u32 __iomem *status_reg; u32 __iomem *status_reg;
u32 temp; u32 temp, port_index;
unsigned long flags; unsigned long flags;
int retval = 0; int retval = 0;
bool done = false; bool done = false;
struct device *dev = hcd->self.controller; struct device *dev = hcd->self.controller;
struct ci_hdrc *ci = dev_get_drvdata(dev); struct ci_hdrc *ci = dev_get_drvdata(dev);
status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1]; port_index = wIndex & 0xff;
port_index -= (port_index > 0);
status_reg = &ehci->regs->port_status[port_index];
spin_lock_irqsave(&ehci->lock, flags); spin_lock_irqsave(&ehci->lock, flags);
...@@ -260,6 +263,11 @@ static int ci_ehci_hub_control( ...@@ -260,6 +263,11 @@ static int ci_ehci_hub_control(
} }
if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) { if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
if (!wIndex || wIndex > ports) {
retval = -EPIPE;
goto done;
}
temp = ehci_readl(ehci, status_reg); temp = ehci_readl(ehci, status_reg);
if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) { if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
retval = -EPIPE; retval = -EPIPE;
...@@ -288,7 +296,7 @@ static int ci_ehci_hub_control( ...@@ -288,7 +296,7 @@ static int ci_ehci_hub_control(
ehci_writel(ehci, temp, status_reg); ehci_writel(ehci, temp, status_reg);
} }
set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports); set_bit(port_index, &ehci->suspended_ports);
goto done; goto done;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册