This is a note to let you know that I've just added the patch titled
Subject: USB: gadget: at91_udc minor fix (there is no number six)
to my gregkh-2.6 tree. Its filename is
usb-gadget-at91_udc-minor-fix.patch
This tree can be found at
http://www.kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/patches/
>From [EMAIL PROTECTED] Sun Dec 9 22:53:23 2007
From: David Brownell <[EMAIL PROTECTED]>
Date: Sun, 9 Dec 2007 22:53:09 -0800
Subject: USB: gadget: at91_udc minor fix (there is no number six)
To: Greg KH <[EMAIL PROTECTED]>
Cc: "Yannick Cote" <[EMAIL PROTECTED]>, USB list <linux-usb@vger.kernel.org>
Message-ID: <[EMAIL PROTECTED]>
Content-Disposition: inline
Fix a small glitch noted by Yannick Cote. There is no endpoint number
six, so if a (broken) host wrongly tried to change or read status of
that endpoint, the driver could access reserved register space.
Signed-off-by: David Brownell <[EMAIL PROTECTED]>
Cc: Yannick Cote <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
---
drivers/usb/gadget/at91_udc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1153,7 +1153,7 @@ static void handle_setup(struct at91_udc
| USB_REQ_GET_STATUS:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc))
+ if (tmp >= NUM_ENDPOINTS || (tmp && !ep->desc))
goto stall;
if (tmp) {
@@ -1176,7 +1176,7 @@ static void handle_setup(struct at91_udc
| USB_REQ_SET_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
+ if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall;
if (!ep->desc || ep->is_iso)
goto stall;
@@ -1195,7 +1195,7 @@ static void handle_setup(struct at91_udc
| USB_REQ_CLEAR_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
+ if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall;
if (tmp == 0)
goto succeed;
Patches currently in gregkh-2.6 which might be from [EMAIL PROTECTED] are
usb/usb-convert-ehci-debug-files-to-use-debugfs-instead-of-sysfs.patch
usb/usb-convert-ohci-debug-files-to-use-debugfs-instead-of-sysfs.patch
usb/usb-ehci-add-separate-iaa-watchdog-timer.patch
usb/usb-gadget-pxa2xx_udc-supports-inverted-vbus.patch
usb/usb-remove-ohci-useless-masking-unmasking-of-wdh-interrupt.patch
usb/usb-device-dma-support-on-omap2.patch
usb/usb-s3c2410_udc-minor-irq-handler-cleanups.patch
usb/usb-m66592-udc-add-support-for-sh7722-usbf.patch
usb/usb-add-missing-space-to-printk-messages.patch
usb/usb-add-printer-gadget-driver.patch
usb/usb-usb-peripheral-controller-driver-oops-avoidance.patch
usb/usb-gadget-at91_udc-minor-fix.patch
usb/usb-don-t-change-hc-power-state-for-a-freeze.patch
usb/usb-dummy_hcd-don-t-register-drivers-on-the-platform-bus.patch
usb/usb-force-handover-port-to-companion-when-hub_port_connect_change-fails.patch
usb/usb-gadget-code-switches-to-pr_err-and-friends.patch
usb/usb-update-pxa27x-ohci-driver-to-use-clk-support.patch
usb/usb-add-marvell-orion-usb-host-support.patch
usb/usb-ehci-potential-oops-fix-on-arc-tdi-cores.patch
usb/usb-gadget-ethernet-error-path-potential-oops-fix.patch
-
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
