leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dm: usb: Avoid exceeding available array size for storage devices

Browse Source 
The limit on storage devices is USB_MAX_STOR_DEV but we use one extra
element while probing to see if a device is a storage device. Avoid this,
since it causes memory corruption.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Marek Vasut <marex@denx.de>
Tested-by: Stephen Warren <swarren@nvidia.com>
This commit is contained in:
Simon Glass 2016-02-29 15:25:53 -07:00
parent 2a981dc2c6
commit c89e79d419
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
common/usb_storage.c
View File

@ -176,6 +176,13 @@ static int usb_stor_probe_device(struct usb_device *dev)
if (dev == NULL)
return -ENOENT; /* no more devices available */
/* We don't have space to even probe if we hit the maximum */
if (usb_max_devs == USB_MAX_STOR_DEV) {
printf("max USB Storage Device reached: %d stopping\n",
usb_max_devs);
return -ENOSPC;
}
debug("\n\nProbing for storage\n");
if (usb_storage_probe(dev, 0, &usb_stor[usb_max_devs])) {
/* OK, it's a storage device. Iterate over its LUNs
@ -210,13 +217,6 @@ static int usb_stor_probe_device(struct usb_device *dev)
}
}
/* if storage device */
if (usb_max_devs == USB_MAX_STOR_DEV) {
printf("max USB Storage Device reached: %d stopping\n",
usb_max_devs);
return -ENOSPC;
}
return 0;
}