[patch] usb: gadget: fsl_qe_udc: off by one in setup_received_handle()

Peter Chen hzpeterchen at gmail.com
Fri Jul 15 16:34:29 AEST 2016


On Wed, Jul 13, 2016 at 01:14:33PM +0300, Dan Carpenter wrote:
> The udc->eps[] array has USB_MAX_ENDPOINTS elements so > should be >=.
> 
> Fixes: 3948f0e0c999 ('usb: add Freescale QE/CPM USB peripheral controller driver')
> Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
> 
> diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
> index 93d28cb..cf8819a 100644
> --- a/drivers/usb/gadget/udc/fsl_qe_udc.c
> +++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
> @@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
>  			struct qe_ep *ep;
>  
>  			if (wValue != 0 || wLength != 0
> -				|| pipe > USB_MAX_ENDPOINTS)
> +				|| pipe >= USB_MAX_ENDPOINTS)
>  				break;
>  			ep = &udc->eps[pipe];
>  

Acked-by: Peter Chen <peter.chen at nxp.com>

-- 

Best Regards,
Peter Chen


More information about the Linuxppc-dev mailing list