xhci: fix potential array out of bounds with several interrupters
authorMathias Nyman <mathias.nyman@linux.intel.com>
Tue, 6 Apr 2021 07:02:07 +0000 (10:02 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 6 Apr 2021 09:16:56 +0000 (11:16 +0200)
commit286fd02fd54b6acab65809549cf5fb3f2a886696
treed921a798125226aedbe11c27ce16f3360737e3b2
parent597899d2f7c5619c87185ee7953d004bd37fd0eb
xhci: fix potential array out of bounds with several interrupters

The Max Interrupters supported by the controller is given in a 10bit
wide bitfield, but the driver uses a fixed 128 size array to index these
interrupters.

Klockwork reports a possible array out of bounds case which in theory
is possible. In practice this hasn't been hit as a common number of Max
Interrupters for new controllers is 8, not even close to 128.

This needs to be fixed anyway

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210406070208.3406266-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci.c