In function last_trb() and last_trb_on_last_seg(), incorrect array index value 'TRBS_PER_SEGMENT' is used to determine the last element in an event ring segment, which lead to the out-of-bounds
of index. But according to the current logic of event ring operation, this "bug" brings no problems and the driver works as desired. This patch only fix this array index out-of-bounds issue and there is
no need no modify corresponding ring operation.
Signed-off-by: Lin Wang <lin.x.wang@xxxxxxxxx>
---
drivers/usb/host/xhci-ring.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d26cd94..3f93b07 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -98,21 +98,21 @@ static bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring *ring,
struct xhci_segment *seg, union xhci_trb *trb)
{
if (ring == xhci->event_ring)
- return (trb == &seg->trbs[TRBS_PER_SEGMENT]) &&
+ return (trb == &seg->trbs[TRBS_PER_SEGMENT - 1]) &&
(seg->next == xhci->event_ring->first_seg);
else
return le32_to_cpu(trb->link.control) & LINK_TOGGLE;
}
-/* Is this TRB a link TRB or was the last TRB the last TRB in this event ring
- * segment? I.e. would the updated event TRB pointer step off the end of the
- * event seg?
+/* Is this TRB a link TRB or was the last TRB in this event ring segment?
+ * I.e. would the updated event TRB pointer step off the end of the event
+ * seg?
*/
static int last_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
struct xhci_segment *seg, union xhci_trb *trb)
{
if (ring == xhci->event_ring)
- return trb == &seg->trbs[TRBS_PER_SEGMENT];
+ return trb == &seg->trbs[TRBS_PER_SEGMENT - 1];
else
return TRB_TYPE_LINK_LE32(trb->link.control);
}
--
1.7.12.4
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
