]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commitdiff
staging: most: usb: sanity check channel before using it as an index into arrays
authorColin Ian King <colin.king@canonical.com>
Thu, 7 May 2020 15:06:52 +0000 (16:06 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 13 May 2020 11:51:12 +0000 (13:51 +0200)
Currently channel is being sanity checked after it has been used as
an index into some arrays. Fix this by moving the sanity check of
channel before the arrays are indexed with it.

Addresses-Coverity: ("Negative array index read")
Fixes: 59ed0480b950 ("Staging: most: replace pr_*() functions by dev_*()")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20200507150652.52238-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/most/usb/usb.c

index daa5e4bd977f89fc47ea647a06d0c5cddb7da635..a4bf36279a553e65c59c762f8ec69d2dcfa78287 100644 (file)
@@ -664,11 +664,6 @@ static int hdm_configure_channel(struct most_interface *iface, int channel,
        struct most_dev *mdev = to_mdev(iface);
        struct device *dev = &mdev->usb_device->dev;
 
-       mdev->is_channel_healthy[channel] = true;
-       mdev->clear_work[channel].channel = channel;
-       mdev->clear_work[channel].mdev = mdev;
-       INIT_WORK(&mdev->clear_work[channel].ws, wq_clear_halt);
-
        if (!conf) {
                dev_err(dev, "Bad config pointer.\n");
                return -EINVAL;
@@ -677,6 +672,12 @@ static int hdm_configure_channel(struct most_interface *iface, int channel,
                dev_err(dev, "Channel ID out of range.\n");
                return -EINVAL;
        }
+
+       mdev->is_channel_healthy[channel] = true;
+       mdev->clear_work[channel].channel = channel;
+       mdev->clear_work[channel].mdev = mdev;
+       INIT_WORK(&mdev->clear_work[channel].ws, wq_clear_halt);
+
        if (!conf->num_buffers || !conf->buffer_size) {
                dev_err(dev, "Misconfig: buffer size or #buffers zero.\n");
                return -EINVAL;