diff options
author | Kuo-Jung Su <dantesu@faraday-tech.com> | 2015-08-25 15:59:58 +0300 |
---|---|---|
committer | Sascha Hauer <s.hauer@pengutronix.de> | 2015-08-26 14:19:33 +0200 |
commit | 75ab53df5fb8ff19814d75ce6aa856e24c6bf50a (patch) | |
tree | 2fde6c9bc8031f45dd7aab322f299e90cad19f52 | |
parent | 484a1fb56890fee13a73070e0d868a3349a47c19 (diff) | |
download | barebox-75ab53df5fb8ff19814d75ce6aa856e24c6bf50a.tar.gz barebox-75ab53df5fb8ff19814d75ce6aa856e24c6bf50a.tar.xz |
usb: ehci: prevent bad PORTSC register access
1. The 'index' of ehci_submit_root() is not always > 0.
e.g.
While it gets invoked from usb_get_descriptor(),
the 'index' is always a '0'. (See ch.9 of USB2.0)
2. The PORTSC register is not always required, and thus it
should only report a port error when necessary.
It would cause a port scan failure if the ehci_submit_root()
always gets terminated by a port error.
Signed-off-by: Kuo-Jung Su <dantesu@faraday-tech.com>
Signed-off-by: Peter Mamonov <pmamonov@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
-rw-r--r-- | drivers/usb/host/ehci-hcd.c | 21 |
1 files changed, 15 insertions, 6 deletions
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index 8a6bbc9fb3..25e7a3e520 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -477,12 +477,6 @@ ehci_submit_root(struct usb_device *dev, unsigned long pipe, void *buffer, uint32_t *status_reg; int port = le16_to_cpu(req->index); - if (le16_to_cpu(req->index) >= CONFIG_SYS_USB_EHCI_MAX_ROOT_PORTS) { - dev_err(ehci->dev, "The request port(%d) is not configured\n", - port - 1); - return -1; - } - status_reg = (uint32_t *)&ehci->hcor->or_portsc[le16_to_cpu(req->index) - 1]; srclen = 0; dev_dbg(ehci->dev, "req=%u (%#x), type=%u (%#x), value=%u, index=%u\n", @@ -493,6 +487,21 @@ ehci_submit_root(struct usb_device *dev, unsigned long pipe, void *buffer, typeReq = req->request | (req->requesttype << 8); switch (typeReq) { + case USB_REQ_GET_STATUS | ((USB_RT_PORT | USB_DIR_IN) << 8): + case USB_REQ_SET_FEATURE | ((USB_DIR_OUT | USB_RT_PORT) << 8): + case USB_REQ_CLEAR_FEATURE | ((USB_DIR_OUT | USB_RT_PORT) << 8): + if (!port || port > CONFIG_SYS_USB_EHCI_MAX_ROOT_PORTS) { + printf("The request port(%d) is not configured\n", port - 1); + return -1; + } + status_reg = (uint32_t *)&ehci->hcor->or_portsc[port - 1]; + break; + default: + status_reg = NULL; + break; + } + + switch (typeReq) { case DeviceRequest | USB_REQ_GET_DESCRIPTOR: switch (le16_to_cpu(req->value) >> 8) { case USB_DT_DEVICE: |