From: Kevin Hilman <khilman@deeprootsystems.com>
Date: Mon, 15 Sep 2008 10:09:31 +0000 (+0200)
Subject: MUSB: Add sanity check for maximum number of endpoints
X-Git-Tag: v2.6.28-rc1~254^2~58
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=02582b92f60fa33b68b90263013e98550286db0a;p=linux-2.6-omap-h63xx.git

MUSB: Add sanity check for maximum number of endpoints

There is no check if platform code passes in more endpoints (num_eps)
than the maximum number of enpoints (MUSB_C_NUM_EPS.)  The result is
that allocate_instance() happily writes past the end of 'struct musb'
corrupting memory.

This patch adds a BUG() if the platform code requests more than the max.

Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 128e949db47..bd82253a332 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1806,6 +1806,7 @@ allocate_instance(struct device *dev,
 	musb->ctrl_base = mbase;
 	musb->nIrq = -ENODEV;
 	musb->config = config;
+	BUG_ON(musb->config->num_eps > MUSB_C_NUM_EPS);
 	for (epnum = 0, ep = musb->endpoints;
 			epnum < musb->config->num_eps;
 			epnum++, ep++) {