hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

USB: EHCI: Improve port index sanitizing 

Now that Kees Cook has added a definition for HCS_N_PORTS_MAX in
commit 72dd184323 ("USB: EHCI: Add register array bounds to HCS
ports"), the code in ehci_hub_control() which sanitizes port index
values can be improved a little.

The idea behind this change is that it prevents a possible
out-of-bounds pointer computation, which the compiler might be able to
detect since the port_status[] array now has a fixed length rather
than a variable length.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20211002190217.GA537967@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alan Stern 2021-10-02 15:02:17 -04:00 committed by Greg Kroah-Hartman
parent ef53d3db1c
commit 846cbf98cb
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/usb/host/ehci-hub.c
View File

@ -745,12 +745,13 @@ int ehci_hub_control(
unsigned selector;
/*
* Avoid underflow while calculating (wIndex & 0xff) - 1.
* The compiler might deduce that wIndex can never be 0 and then
* optimize away the tests for !wIndex below.
* Avoid out-of-bounds values while calculating the port index
* from wIndex. The compiler doesn't like pointers to invalid
* addresses, even if they are never used.
*/
temp = wIndex & 0xff;
temp -= (temp > 0);
temp = (wIndex - 1) & 0xff;
if (temp >= HCS_N_PORTS_MAX)
temp = 0;
status_reg = &ehci->regs->port_status[temp];
hostpc_reg = &ehci->regs->hostpc[temp];