diff options
| author | Octavian Purdila <octavian.purdila@intel.com> | 2014-11-18 12:57:59 (GMT) |
|---|---|---|
| committer | Lee Jones <lee.jones@linaro.org> | 2014-11-19 17:12:50 (GMT) |
| commit | 00ee7a37fdc3ed9bc6315f8af0270f2df55437d7 (patch) | |
| tree | 87189f2932f9c28f0944c4093106d4d31b2e14f3 /drivers/mfd/dln2.c | |
| parent | 9331642812b19313ca4c545b37c001d68efb7022 (diff) | |
| download | linux-00ee7a37fdc3ed9bc6315f8af0270f2df55437d7.tar.xz | |
mfd: dln2: Add a limit check for invalid echo
The echo field in dln2_transfer_complete comes directly from an USB
transfer and we should not trust it is valid.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Diffstat (limited to 'drivers/mfd/dln2.c')
| -rw-r--r-- | drivers/mfd/dln2.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c index cf22841..df2fda9 100644 --- a/drivers/mfd/dln2.c +++ b/drivers/mfd/dln2.c @@ -195,6 +195,9 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb, struct dln2_rx_context *rxc; bool valid_slot = false; + if (rx_slot >= DLN2_MAX_RX_SLOTS) + goto out; + rxc = &rxs->slots[rx_slot]; /* @@ -210,6 +213,7 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb, } spin_unlock(&rxs->lock); +out: if (!valid_slot) dev_warn(dev, "bad/late response %d/%d\n", handle, rx_slot); |