usb: chipidea: host: fix port index underflow and UBSAN complains

If wIndex is 0 (and it often is), these calculations underflow and
UBSAN complains, here resolve this by not decrementing the index when
it is equal to 0, this copies the solution from commit 85e3990bea49
("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")

Reported-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com
Signed-off-by: Peter Chen <peter.chen@kernel.org>

diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index e86d13c04bdbe5b7e3f18797fbbacfd230d9f8c9..bdc3885c0d493c14e8abb6fe0c284cd5938eb137 100644 (file)
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -240,15 +240,18 @@ static int ci_ehci_hub_control(
 )
 {
        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+       unsigned int    ports = HCS_N_PORTS(ehci->hcs_params);
        u32 __iomem     *status_reg;
-       u32             temp;
+       u32             temp, port_index;
        unsigned long   flags;
        int             retval = 0;
        bool            done = false;
        struct device *dev = hcd->self.controller;
        struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-       status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
+       port_index = wIndex & 0xff;
+       port_index -= (port_index > 0);
+       status_reg = &ehci->regs->port_status[port_index];
 
        spin_lock_irqsave(&ehci->lock, flags);
 
@@ -260,6 +263,11 @@ static int ci_ehci_hub_control(
        }
 
        if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
+               if (!wIndex || wIndex > ports) {
+                       retval = -EPIPE;
+                       goto done;
+               }
+
                temp = ehci_readl(ehci, status_reg);
                if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
                        retval = -EPIPE;
@@ -288,7 +296,7 @@ static int ci_ehci_hub_control(
                        ehci_writel(ehci, temp, status_reg);
                }
 
-               set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
+               set_bit(port_index, &ehci->suspended_ports);
                goto done;
        }