From: Yu Wang <yu.y.wang@intel.com>
Date: Tue, 8 May 2012 06:59:40 +0000 (+0800)
Subject: xHCI: Add error handle for event completed handler.
X-Git-Tag: 2.1b_release~756
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=119229eb8dc1e13726099cd093ce965f4f80abe5;p=kernel%2Fkernel-mfld-blackbay.git

xHCI: Add error handle for event completed handler.

BZ: 35199

This is klockwork tool build error. The ep_index variable possible equal
to -1, then cause the eps array overflow.

Change-Id: If7722a411d6cb415ba0481fc6a0e4784adc469f3
Signed-off-by: Yu Wang <yu.y.wang@intel.com>
Reviewed-on: http://android.intel.com:8080/47758
Reviewed-by: Tang, Richard <richard.tang@intel.com>
Tested-by: Gao, Yunpeng <yunpeng.gao@intel.com>
Reviewed-by: buildbot <buildbot@intel.com>
Tested-by: buildbot <buildbot@intel.com>
---

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d0871ea..3a98363 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1952,6 +1952,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 
 	/* Endpoint ID is 1 based, our index is zero based */
 	ep_index = TRB_TO_EP_ID(le32_to_cpu(event->flags)) - 1;
+	if (ep_index == -1) {
+		xhci_err(xhci, "ERROR event endpoint index should start from one\n ");
+		return -EINVAL;
+	}
 	ep = &xdev->eps[ep_index];
 	ep_ring = xhci_dma_to_transfer_ring(ep, le64_to_cpu(event->buffer));
 	ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);