If the path is not complete when we do discovery the number of hops may be less than with the full path. As an example when this can happen is that user unloads the driver, disconnects the topology, and loads the driver back. If there is PCIe or USB3 tunnel involved this may happen. Take this into account in tb_pcie_init_path() and tb_usb3_init_path() and prevent potential access over array limits. Signed-off-by: Mika Westerberg <mika.westerberg@xxxxxxxxxxxxxxx> --- drivers/thunderbolt/tunnel.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c index c144ca9b032c..5bdb8b11345e 100644 --- a/drivers/thunderbolt/tunnel.c +++ b/drivers/thunderbolt/tunnel.c @@ -124,8 +124,9 @@ static void tb_pci_init_path(struct tb_path *path) path->drop_packages = 0; path->nfc_credits = 0; path->hops[0].initial_credits = 7; - path->hops[1].initial_credits = - tb_initial_credits(path->hops[1].in_port->sw); + if (path->path_length > 1) + path->hops[1].initial_credits = + tb_initial_credits(path->hops[1].in_port->sw); } /** @@ -879,8 +880,9 @@ static void tb_usb3_init_path(struct tb_path *path) path->drop_packages = 0; path->nfc_credits = 0; path->hops[0].initial_credits = 7; - path->hops[1].initial_credits = - tb_initial_credits(path->hops[1].in_port->sw); + if (path->path_length > 1) + path->hops[1].initial_credits = + tb_initial_credits(path->hops[1].in_port->sw); } /** -- 2.27.0.rc2
