usb: gadget: f_tcm: out of bound access in usbg_drop_tpg
authorHeinrich Schuchardt <xypron.glpk@gmx.de>
Sun, 8 May 2016 20:50:12 +0000 (22:50 +0200)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Tue, 31 May 2016 08:24:30 +0000 (11:24 +0300)
commite877b729c649c2850f61f2ae37296ae701f9ad63
tree428e47fa38118e7af581ff0a3e36e7f35351a5cf
parentffeee83aa0461992e8a99a59db2df31933e60362
usb: gadget: f_tcm: out of bound access in usbg_drop_tpg

Commit dc8c46a5ae77 ("usb: gadget: f_tcm: convert to new function
interface with backward compatibility") introduced a possible out
of bounds memory access:

If tpg is not found in function usbg_drop_tpg,
tpg_instances[TPG_INSTANCES] is accessed.

Fixes: dc8c46a5ae77 ("usb: gadget: f_tcm: convert to new function interface with backward compatibility")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/gadget/function/f_tcm.c