diff options
| author | Artur Petrosyan <Arthur.Petrosyan@synopsys.com> | 2018-05-05 11:30:16 +0300 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2018-05-15 10:16:50 +0300 |
| commit | d5d5f079138254e4d641de2f36760d0d0fc9f510 (patch) | |
| tree | 87280d9b484418a1a61350495e365af569960b94 /drivers/usb/dwc2/gadget.c | |
| parent | b43ebc96e985fed9417c6aff769a6839bdaa6cdf (diff) | |
| download | linux-d5d5f079138254e4d641de2f36760d0d0fc9f510.tar.xz | |
usb: dwc2: Fix crash in incomplete isoc intr handlers.
Crash caused by going out of "eps_out" array range.
Iteration on "eps_out" changed to less than "num_of_eps".
Signed-off-by: Artur Petrosyan <arturp@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb/dwc2/gadget.c')
| -rw-r--r-- | drivers/usb/dwc2/gadget.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c index abd22b4f8c99..37ee467abea9 100644 --- a/drivers/usb/dwc2/gadget.c +++ b/drivers/usb/dwc2/gadget.c @@ -3409,7 +3409,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg) daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { + for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_in[idx]; /* Proceed only unmasked ISOC EPs */ if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) @@ -3455,7 +3455,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg) daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); daintmsk >>= DAINT_OUTEP_SHIFT; - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { + for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_out[idx]; /* Proceed only unmasked ISOC EPs */ if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) @@ -3629,7 +3629,7 @@ irq_retry: dwc2_writel(gintmsk, hsotg->regs + GINTMSK); dev_dbg(hsotg->dev, "GOUTNakEff triggered\n"); - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { + for (idx = 1; idx < hsotg->num_of_eps; idx++) { hs_ep = hsotg->eps_out[idx]; /* Proceed only unmasked ISOC EPs */ if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) |