usb: chipidea: host: fix port index underflow and UBSAN complains

[ Upstream commit e5d6a7c6cfae9e714a0e8ff64facd1ac68a784c6 ]

If wIndex is 0 (and it often is), these calculations underflow and
UBSAN complains, here resolve this by not decrementing the index when
it is equal to 0, this copies the solution from commit 3f82d0e43320
("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")

Reported-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com
Signed-off-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 48e4a5ca183591fd577b9e3cc9e0174a3b739beb..f5f56ee07729fe6d18f59b386575ee8f89dd4014 100644 (file)
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -233,18 +233,26 @@ static int ci_ehci_hub_control(
 )
 {
        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+       unsigned int    ports = HCS_N_PORTS(ehci->hcs_params);
        u32 __iomem     *status_reg;
-       u32             temp;
+       u32             temp, port_index;
        unsigned long   flags;
        int             retval = 0;
        struct device *dev = hcd->self.controller;
        struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-       status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
+       port_index = wIndex & 0xff;
+       port_index -= (port_index > 0);
+       status_reg = &ehci->regs->port_status[port_index];
 
        spin_lock_irqsave(&ehci->lock, flags);
 
        if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
+               if (!wIndex || wIndex > ports) {
+                       retval = -EPIPE;
+                       goto done;
+               }
+
                temp = ehci_readl(ehci, status_reg);
                if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
                        retval = -EPIPE;
@@ -273,7 +281,7 @@ static int ci_ehci_hub_control(
                        ehci_writel(ehci, temp, status_reg);
                }
 
-               set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
+               set_bit(port_index, &ehci->suspended_ports);
                goto done;
        }