OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mfd: dln2: Add a limit check for invalid echo 

The echo field in dln2_transfer_complete comes directly from an USB
transfer and we should not trust it is valid.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
This commit is contained in:
Octavian Purdila 2014-11-18 14:57:59 +02:00 committed by Lee Jones
parent 9331642812
commit 00ee7a37fd
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/mfd/dln2.c
View File

@ -195,6 +195,9 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb,
struct dln2_rx_context *rxc;
bool valid_slot = false;
if (rx_slot >= DLN2_MAX_RX_SLOTS)
goto out;
rxc = &rxs->slots[rx_slot];
/*
@ -210,6 +213,7 @@ static bool dln2_transfer_complete(struct dln2_dev *dln2, struct urb *urb,
}
spin_unlock(&rxs->lock);
out:
if (!valid_slot)
dev_warn(dev, "bad/late response %d/%d\n", handle, rx_slot);