summaryrefslogtreecommitdiffstats
path: root/drivers/usb/gadget/at91_udc.c
diff options
context:
space:
mode:
authorDavid Brownell <david-b@pacbell.net>2007-12-09 22:53:09 -0800
committerGreg Kroah-Hartman <gregkh@suse.de>2008-02-01 14:34:59 -0800
commit1440e0967de8c598dae96d741652d498b3eb8f27 (patch)
treec00b72257474bbdf10d16f598d7c3e836eba65c6 /drivers/usb/gadget/at91_udc.c
parente58679805dab3fb75df88141d9d869904a93337f (diff)
USB: gadget: at91_udc minor fix (there is no number six)
Fix a small glitch noted by Yannick Cote. There is no endpoint number six, so if a (broken) host wrongly tried to change or read status of that endpoint, the driver could access reserved register space. Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Cc: Yannick Cote <yanick@yanos.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/gadget/at91_udc.c')
-rw-r--r--drivers/usb/gadget/at91_udc.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 4b6ed353ae3..305db36a3b1 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1153,7 +1153,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
| USB_REQ_GET_STATUS:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (tmp > NUM_ENDPOINTS || (tmp && !ep->desc))
+ if (tmp >= NUM_ENDPOINTS || (tmp && !ep->desc))
goto stall;
if (tmp) {
@@ -1176,7 +1176,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
| USB_REQ_SET_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
+ if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall;
if (!ep->desc || ep->is_iso)
goto stall;
@@ -1195,7 +1195,7 @@ static void handle_setup(struct at91_udc *udc, struct at91_ep *ep, u32 csr)
| USB_REQ_CLEAR_FEATURE:
tmp = w_index & USB_ENDPOINT_NUMBER_MASK;
ep = &udc->ep[tmp];
- if (w_value != USB_ENDPOINT_HALT || tmp > NUM_ENDPOINTS)
+ if (w_value != USB_ENDPOINT_HALT || tmp >= NUM_ENDPOINTS)
goto stall;
if (tmp == 0)
goto succeed;