MUSB: Add sanity check for maximum number of endpoints

There is no check if platform code passes in more endpoints (num_eps)
than the maximum number of enpoints (MUSB_C_NUM_EPS.)  The result is
that allocate_instance() happily writes past the end of 'struct musb'
corrupting memory.

This patch adds a BUG() if the platform code requests more than the max.

Signed-off-by: Kevin Hilman <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 128e949db47c4a2c64f0156a2c7c227ef8f16fd1..bd82253a3329014803a35541135a008b93f82b57 100644 (file)
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1806,6 +1806,7 @@ allocate_instance(struct device *dev,
        musb->ctrl_base = mbase;
        musb->nIrq = -ENODEV;
        musb->config = config;
+       BUG_ON(musb->config->num_eps > MUSB_C_NUM_EPS);
        for (epnum = 0, ep = musb->endpoints;
                        epnum < musb->config->num_eps;
                        epnum++, ep++) {