From: Akinobu Mita <akinobu.mita@xxxxxxxxx> In wusb_cluster_id_get(), if no zero bits exist in wusb_cluster_id_table, find_first_zero_bit() returns CLUSTER_IDS. But it is impossible to detect that the bitmap is full because there is an off-by-one error in the return value check. It will cause unexpected memory access by setting bit out of wusb_cluster_id_table bitmap, and caller will get wrong cluster id. Signed-off-by: Akinobu Mita <akinobu.mita@xxxxxxxxx> Cc: linux-usb@xxxxxxxxxxxxxxx Cc: Greg Kroah-Hartman <gregkh@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx> --- drivers/usb/wusbcore/wusbhc.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/usb/wusbcore/wusbhc.c b/drivers/usb/wusbcore/wusbhc.c index 2054d4e..0faca16 100644 --- a/drivers/usb/wusbcore/wusbhc.c +++ b/drivers/usb/wusbcore/wusbhc.c @@ -320,7 +320,7 @@ u8 wusb_cluster_id_get(void) u8 id; spin_lock(&wusb_cluster_ids_lock); id = find_first_zero_bit(wusb_cluster_id_table, CLUSTER_IDS); - if (id > CLUSTER_IDS) { + if (id >= CLUSTER_IDS) { id = 0; goto out; } -- 1.7.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html