* [patch] usb: gadget: fsl_qe_udc: off by one in setup_received_handle()
@ 2016-07-13 10:14 Dan Carpenter
2016-07-15 6:34 ` Peter Chen
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2016-07-13 10:14 UTC (permalink / raw)
To: Li Yang, Xie Xiaobo
Cc: Felipe Balbi, Greg Kroah-Hartman, linux-usb, linuxppc-dev,
kernel-janitors
The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.
Fixes: 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 93d28cb..cf8819a 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
struct qe_ep *ep;
if (wValue != 0 || wLength != 0
- || pipe > USB_MAX_ENDPOINTS)
+ || pipe >= USB_MAX_ENDPOINTS)
break;
ep = &udc->eps[pipe];
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch] usb: gadget: fsl_qe_udc: off by one in setup_received_handle()
2016-07-13 10:14 [patch] usb: gadget: fsl_qe_udc: off by one in setup_received_handle() Dan Carpenter
@ 2016-07-15 6:34 ` Peter Chen
0 siblings, 0 replies; 2+ messages in thread
From: Peter Chen @ 2016-07-15 6:34 UTC (permalink / raw)
To: Dan Carpenter
Cc: Li Yang, Xie Xiaobo, Felipe Balbi, Greg Kroah-Hartman, linux-usb,
linuxppc-dev, kernel-janitors
On Wed, Jul 13, 2016 at 01:14:33PM +0300, Dan Carpenter wrote:
> The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.
>
> Fixes: 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
> index 93d28cb..cf8819a 100644
> --- a/drivers/usb/gadget/udc/fsl_qe_udc.c
> +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
> @@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
> struct qe_ep *ep;
>
> if (wValue != 0 || wLength != 0
> - || pipe > USB_MAX_ENDPOINTS)
> + || pipe >= USB_MAX_ENDPOINTS)
> break;
> ep = &udc->eps[pipe];
>
Acked-by: Peter Chen <peter.chen@nxp.com>
--
Best Regards,
Peter Chen
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-07-15 6:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-07-13 10:14 [patch] usb: gadget: fsl_qe_udc: off by one in setup_received_handle() Dan Carpenter
2016-07-15 6:34 ` Peter Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).