Commit d5d5f079 authored by Artur Petrosyan's avatar Artur Petrosyan Committed by Felipe Balbi
Browse files

usb: dwc2: Fix crash in incomplete isoc intr handlers. 



Crash caused by going out of "eps_out" array range.
Iteration on "eps_out" changed to less than "num_of_eps".

Signed-off-by: default avatarArtur Petrosyan <arturp@synopsys.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent b43ebc96

drivers/usb/dwc2/gadget.c

+3 −3
Original line number Diff line number Diff line
@@ -3409,7 +3409,7 @@ static void dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg) 


	daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);



	for (idx = 1; idx <= hsotg->num_of_eps; idx++) {

	for (idx = 1; idx < hsotg->num_of_eps; idx++) {

		hs_ep = hsotg->eps_in[idx];

		/* Proceed only unmasked ISOC EPs */

		if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
@@ -3455,7 +3455,7 @@ static void dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg) 
	daintmsk = dwc2_readl(hsotg->regs + DAINTMSK);

	daintmsk >>= DAINT_OUTEP_SHIFT;



	for (idx = 1; idx <= hsotg->num_of_eps; idx++) {

	for (idx = 1; idx < hsotg->num_of_eps; idx++) {

		hs_ep = hsotg->eps_out[idx];

		/* Proceed only unmasked ISOC EPs */

		if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))
@@ -3629,7 +3629,7 @@ irq_retry: 
		dwc2_writel(gintmsk, hsotg->regs + GINTMSK);



		dev_dbg(hsotg->dev, "GOUTNakEff triggered\n");

		for (idx = 1; idx <= hsotg->num_of_eps; idx++) {

		for (idx = 1; idx < hsotg->num_of_eps; idx++) {

			hs_ep = hsotg->eps_out[idx];

			/* Proceed only unmasked ISOC EPs */

			if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk))

CRA Git | Maintained and supported by SUSTech CRA and CCSE