]> git.baikalelectronics.ru Git - kernel.git/commit
usb: gadget: f_tcm: out of bound access in usbg_drop_tpg
authorHeinrich Schuchardt <xypron.glpk@gmx.de>
Sun, 8 May 2016 20:50:12 +0000 (22:50 +0200)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Tue, 31 May 2016 08:24:30 +0000 (11:24 +0300)
commite9241d1c0daf60148d29981ced4b9364b308033f
tree428e47fa38118e7af581ff0a3e36e7f35351a5cf
parent88c76bd60a26bc51b48b9cfe77211a99fc8aefa0
usb: gadget: f_tcm: out of bound access in usbg_drop_tpg

Commit facb76647cd0 ("usb: gadget: f_tcm: convert to new function
interface with backward compatibility") introduced a possible out
of bounds memory access:

If tpg is not found in function usbg_drop_tpg,
tpg_instances[TPG_INSTANCES] is accessed.

Fixes: facb76647cd0 ("usb: gadget: f_tcm: convert to new function interface with backward compatibility")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/gadget/function/f_tcm.c