xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
commitpull/10/head313db3d648
upstream. The > should be >= here so that we don't read one element beyond the end of the ep->stream_info->stream_rings[] array. Fixes:e9df17eb14
("USB: xhci: Correct assumptions about number of rings per endpoint.") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
55f51e5b4c
commit
7499390b8b
|
@ -604,7 +604,7 @@ struct xhci_ring *xhci_stream_id_to_ring(
|
|||
if (!ep->stream_info)
|
||||
return NULL;
|
||||
|
||||
if (stream_id > ep->stream_info->num_streams)
|
||||
if (stream_id >= ep->stream_info->num_streams)
|
||||
return NULL;
|
||||
return ep->stream_info->stream_rings[stream_id];
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue