[PATCH] usbip: vhci_hcd: Check rhport everywhere in vhci_hub_control()

[Ben Hutchings <ben@xxxxxxxxxxxxxxx>]

Commit 5b22f676118f "usbip: vhci_hcd: check rhport before using in
vhci_hub_control()" added some validation of rhport, but left
several problems:

- If VHCI_HC_PORTS < 256, we can get rhport >= VHCI_HC_PORTS which
  is also out of range.  To keep things simple, set rhport to -1 if
  this would happen.
- For GetPortStatus, we range-check wIndex (and by implication
  rhport) and report an error, but *don't* skip the following code.
  Add a goto to the error path.
- At the end of the function, there's one last port_status lookup
  that's not protected by any range check.

Fixes: 5b22f676118f ("usbip: vhci_hcd: check rhport before using in ...")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>
---
 drivers/usb/usbip/vhci_hcd.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index d11f3f8dad40..e259d3812641 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -334,9 +334,12 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 	usbip_dbg_vhci_rh("typeReq %x wValue %x wIndex %x\n", typeReq, wValue,
 			  wIndex);
 
-	if (wIndex > VHCI_HC_PORTS)
+	if (wIndex > VHCI_HC_PORTS) {
 		pr_err("invalid port number %d\n", wIndex);
-	rhport = wIndex - 1;
+		rhport = -1;
+	} else {
+		rhport = wIndex - 1;
+	}
 
 	vhci_hcd = hcd_to_vhci_hcd(hcd);
 	vhci = vhci_hcd->vhci;
@@ -414,10 +417,10 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 		*(__le32 *) buf = cpu_to_le32(0);
 		break;
 	case GetPortStatus:
-		usbip_dbg_vhci_rh(" GetPortStatus port %x\n", wIndex);
-		if (wIndex < 1) {
-			pr_err("invalid port number %d\n", wIndex);
-			retval = -EPIPE;
+		usbip_dbg_vhci_rh(" GetPortStatus port %x\n", rhport);
+		if (rhport < 0) {
+			pr_err("invalid port number %d\n", rhport);
+			goto error;
 		}
 
 		/* we do not care about resume. */
@@ -618,7 +621,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
 	spin_unlock_irqrestore(&vhci->lock, flags);
 
-	if ((vhci_hcd->port_status[rhport] & PORT_C_MASK) != 0)
+	if (rhport >= 0 && (vhci_hcd->port_status[rhport] & PORT_C_MASK) != 0)
 		usb_hcd_poll_rh_status(hcd);
 
 	return retval;

Attachment: signature.asc
Description: Digital signature