Skip to content

Commit 452d1ea

Browse files
committed
Merge tag 'usb-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-next
Peter writes: Only one patch for improving port index calculation for chipidea driver, no big changes. * tag 'usb-v5.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb: usb: chipidea: host: fix port index underflow and UBSAN complains
2 parents d98a30c + e5d6a7c commit 452d1ea

File tree

1 file changed

+11
-3
lines changed

1 file changed

+11
-3
lines changed

drivers/usb/chipidea/host.c

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -240,15 +240,18 @@ static int ci_ehci_hub_control(
240240
)
241241
{
242242
struct ehci_hcd *ehci = hcd_to_ehci(hcd);
243+
unsigned int ports = HCS_N_PORTS(ehci->hcs_params);
243244
u32 __iomem *status_reg;
244-
u32 temp;
245+
u32 temp, port_index;
245246
unsigned long flags;
246247
int retval = 0;
247248
bool done = false;
248249
struct device *dev = hcd->self.controller;
249250
struct ci_hdrc *ci = dev_get_drvdata(dev);
250251

251-
status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
252+
port_index = wIndex & 0xff;
253+
port_index -= (port_index > 0);
254+
status_reg = &ehci->regs->port_status[port_index];
252255

253256
spin_lock_irqsave(&ehci->lock, flags);
254257

@@ -260,6 +263,11 @@ static int ci_ehci_hub_control(
260263
}
261264

262265
if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
266+
if (!wIndex || wIndex > ports) {
267+
retval = -EPIPE;
268+
goto done;
269+
}
270+
263271
temp = ehci_readl(ehci, status_reg);
264272
if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
265273
retval = -EPIPE;
@@ -288,7 +296,7 @@ static int ci_ehci_hub_control(
288296
ehci_writel(ehci, temp, status_reg);
289297
}
290298

291-
set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
299+
set_bit(port_index, &ehci->suspended_ports);
292300
goto done;
293301
}
294302

0 commit comments

Comments
 (0)