Gitweb: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=02582b...
Commit: 02582b92f60fa33b68b90263013e98550286db0a
Parent: cede969fe21adece300300a455580635590deb47
Author: Kevin Hilman <khilman@deeprootsystems.com>
AuthorDate: Mon Sep 15 12:09:31 2008 +0200
Committer: Greg Kroah-Hartman <gregkh@suse.de>
CommitDate: Fri Oct 17 14:40:58 2008 -0700
MUSB: Add sanity check for maximum number of endpoints
There is no check if platform code passes in more endpoints (num_eps)
than the maximum number of enpoints (MUSB_C_NUM_EPS.) The result is
that allocate_instance() happily writes past the end of 'struct musb'
corrupting memory.
This patch adds a BUG() if the platform code requests more than the max.
Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/musb/musb_core.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 128e949..bd82253 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1806,6 +1806,7 @@ allocate_instance(struct device *dev,
musb->ctrl_base = mbase;
musb->nIrq = -ENODEV;
musb->config = config;
+ BUG_ON(musb->config->num_eps > MUSB_C_NUM_EPS);
for (epnum = 0, ep = musb->endpoints;
epnum < musb->config->num_eps;
epnum++, ep++) {
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
