On 5/5/2018 12:30 PM, Artur Petrosyan wrote: > Crash caused by going out of "eps_out" array range. > Iteration on "eps_out" changed to less than "num_of_eps". > > Signed-off-by: Artur Petrosyan <art...@synopsys.com> > --- Acked-by: Minas Harutyunyan <hmi...@synopsys.com>
> drivers/usb/dwc2/gadget.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c > index 6c32bf26e48e..010cfbca962a 100644 > --- a/drivers/usb/dwc2/gadget.c > +++ b/drivers/usb/dwc2/gadget.c > @@ -3427,7 +3427,7 @@ static void > dwc2_gadget_handle_incomplete_isoc_in(struct dwc2_hsotg *hsotg) > > daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); > > - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { > + for (idx = 1; idx < hsotg->num_of_eps; idx++) { > hs_ep = hsotg->eps_in[idx]; > /* Proceed only unmasked ISOC EPs */ > if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) > @@ -3473,7 +3473,7 @@ static void > dwc2_gadget_handle_incomplete_isoc_out(struct dwc2_hsotg *hsotg) > daintmsk = dwc2_readl(hsotg->regs + DAINTMSK); > daintmsk >>= DAINT_OUTEP_SHIFT; > > - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { > + for (idx = 1; idx < hsotg->num_of_eps; idx++) { > hs_ep = hsotg->eps_out[idx]; > /* Proceed only unmasked ISOC EPs */ > if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) > @@ -3647,7 +3647,7 @@ static irqreturn_t dwc2_hsotg_irq(int irq, void *pw) > dwc2_writel(gintmsk, hsotg->regs + GINTMSK); > > dev_dbg(hsotg->dev, "GOUTNakEff triggered\n"); > - for (idx = 1; idx <= hsotg->num_of_eps; idx++) { > + for (idx = 1; idx < hsotg->num_of_eps; idx++) { > hs_ep = hsotg->eps_out[idx]; > /* Proceed only unmasked ISOC EPs */ > if (!hs_ep->isochronous || (BIT(idx) & ~daintmsk)) > -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html