]> git.baikalelectronics.ru Git - kernel.git/commit
usb: gadget: f_tcm: out of bound access in usbg_drop_tpg
authorHeinrich Schuchardt <xypron.glpk@gmx.de>
Sun, 8 May 2016 20:50:12 +0000 (22:50 +0200)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Tue, 31 May 2016 08:24:30 +0000 (11:24 +0300)
commit016dd0add0ddfcf4e44d29d4c7a60993bf919823
tree428e47fa38118e7af581ff0a3e36e7f35351a5cf
parent6662645296c5d468f6729e0acc9ee21dbabbbd86
usb: gadget: f_tcm: out of bound access in usbg_drop_tpg

Commit 58f87434fa10 ("usb: gadget: f_tcm: convert to new function
interface with backward compatibility") introduced a possible out
of bounds memory access:

If tpg is not found in function usbg_drop_tpg,
tpg_instances[TPG_INSTANCES] is accessed.

Fixes: 58f87434fa10 ("usb: gadget: f_tcm: convert to new function interface with backward compatibility")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/gadget/function/f_tcm.c