> From: Of Wang, Lin X
> Sent: 15 December 2013 14:21
> To: Sarah Sharp (sarah.a.sharp@xxxxxxxxxxxxxxx)
> Cc: linux-usb@xxxxxxxxxxxxxxx
> Subject: [PATCH] xhci: fix array index out of the bounds in function last_trb() and
> last_trb_on_last_seg()
>
> In function last_trb() and last_trb_on_last_seg(), incorrect array index value 'TRBS_PER_SEGMENT' is
> used to determine the last element in an event ring segment, which lead to the out-of-bounds
> of index. But according to the current logic of event ring operation, this "bug" brings no problems
> and the driver works as desired. This patch only fix this array index out-of-bounds issue and there is
> no need no modify corresponding ring operation.
>
> Signed-off-by: Lin Wang <lin.x.wang@xxxxxxxxx>
> ---
> drivers/usb/host/xhci-ring.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
> index d26cd94..3f93b07 100644
> --- a/drivers/usb/host/xhci-ring.c
> +++ b/drivers/usb/host/xhci-ring.c
> @@ -98,21 +98,21 @@ static bool last_trb_on_last_seg(struct xhci_hcd *xhci, struct xhci_ring *ring,
> struct xhci_segment *seg, union xhci_trb *trb)
> {
> if (ring == xhci->event_ring)
> - return (trb == &seg->trbs[TRBS_PER_SEGMENT]) &&
> + return (trb == &seg->trbs[TRBS_PER_SEGMENT - 1]) &&
Taking the address of the element beyond the end of an array is valid C.
So there is nothing wrong with this code.
Apply the patch and the last event written by the hardware won't be processed.
David
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
