Patch "xhci: fix off by one check when adding a secondary interrupter." has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    xhci: fix off by one check when adding a secondary interrupter.

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xhci-fix-off-by-one-check-when-adding-a-secondary-in.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b7b4de7b1fca79555ff324d34ff46257bf2b7b52
Author: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
Date:   Thu Jan 25 17:27:35 2024 +0200

    xhci: fix off by one check when adding a secondary interrupter.
    
    [ Upstream commit 09f197225cbc35db8ac135659cdd21bc1e29bda0 ]
    
    The sanity check of interrupter index when adding a new interrupter is
    off by one. intr_num needs to be smaller than xhci->max_interrupter to
    fit the array of interrupters.
    
    Luckily this doesn't cause any real word harm as xhci_add_interrupter()
    is always called with a intr_num value smaller than xhci->max_interrupters
    in any current kernel.
    
    Should not be needed for stable as 6.7 kernel and older only supports
    one interrupter, with intr_num always being zero.
    
    Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Closes: https://lore.kernel.org/linux-usb/e9771296-586d-456a-ac24-a82de79bb2e6@moroto.mountain/
    Fixes: 4bf398e15aa4 ("xhci: split allocate interrupter into separate alloacte and add parts")
    Signed-off-by: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240125152737.2983959-3-mathias.nyman@xxxxxxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 62116586848b..9f27adb255e8 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2286,7 +2286,7 @@ xhci_add_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir,
 	u64 erst_base;
 	u32 erst_size;
 
-	if (intr_num > xhci->max_interrupters) {
+	if (intr_num >= xhci->max_interrupters) {
 		xhci_warn(xhci, "Can't add interrupter %d, max interrupters %d\n",
 			  intr_num, xhci->max_interrupters);
 		return -EINVAL;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux