diff options
| author | Simon Glass <sjg@chromium.org> | 2016-02-29 15:25:53 -0700 |
|---|---|---|
| committer | Simon Glass <sjg@chromium.org> | 2016-03-14 15:34:50 -0600 |
| commit | c89e79d4199cf76f3a018c230d5705df7d2225c6 (patch) | |
| tree | cd6e441f0681c25438862635e4bfb0408427cee2 /common/usb_storage.c | |
| parent | 2a981dc2c62c500110aad297fa70503aec36e689 (diff) | |
| download | u-boot-c89e79d4199cf76f3a018c230d5705df7d2225c6.tar.gz u-boot-c89e79d4199cf76f3a018c230d5705df7d2225c6.tar.bz2 u-boot-c89e79d4199cf76f3a018c230d5705df7d2225c6.zip | |
dm: usb: Avoid exceeding available array size for storage devices
The limit on storage devices is USB_MAX_STOR_DEV but we use one extra
element while probing to see if a device is a storage device. Avoid this,
since it causes memory corruption.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Marek Vasut <marex@denx.de>
Tested-by: Stephen Warren <swarren@nvidia.com>
Diffstat (limited to 'common/usb_storage.c')
| -rw-r--r-- | common/usb_storage.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/common/usb_storage.c b/common/usb_storage.c index 60531e2aa4..f2d2ad9fb2 100644 --- a/common/usb_storage.c +++ b/common/usb_storage.c @@ -176,6 +176,13 @@ static int usb_stor_probe_device(struct usb_device *dev) if (dev == NULL) return -ENOENT; /* no more devices available */ + /* We don't have space to even probe if we hit the maximum */ + if (usb_max_devs == USB_MAX_STOR_DEV) { + printf("max USB Storage Device reached: %d stopping\n", + usb_max_devs); + return -ENOSPC; + } + debug("\n\nProbing for storage\n"); if (usb_storage_probe(dev, 0, &usb_stor[usb_max_devs])) { /* OK, it's a storage device. Iterate over its LUNs @@ -210,13 +217,6 @@ static int usb_stor_probe_device(struct usb_device *dev) } } - /* if storage device */ - if (usb_max_devs == USB_MAX_STOR_DEV) { - printf("max USB Storage Device reached: %d stopping\n", - usb_max_devs); - return -ENOSPC; - } - return 0; } |