From: Simon Glass <sjg@chromium.org>
Date: Mon, 29 Feb 2016 22:25:53 +0000 (-0700)
Subject: dm: usb: Avoid exceeding available array size for storage devices
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=c89e79d4199cf76f3a018c230d5705df7d2225c6;p=project%2Fbcm63xx%2Fu-boot.git

dm: usb: Avoid exceeding available array size for storage devices

The limit on storage devices is USB_MAX_STOR_DEV but we use one extra
element while probing to see if a device is a storage device. Avoid this,
since it causes memory corruption.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Marek Vasut <marex@denx.de>
Tested-by: Stephen Warren <swarren@nvidia.com>
---

diff --git a/common/usb_storage.c b/common/usb_storage.c
index 60531e2aa4..f2d2ad9fb2 100644
--- a/common/usb_storage.c
+++ b/common/usb_storage.c
@@ -176,6 +176,13 @@ static int usb_stor_probe_device(struct usb_device *dev)
 	if (dev == NULL)
 		return -ENOENT; /* no more devices available */
 
+	/* We don't have space to even probe if we hit the maximum */
+	if (usb_max_devs == USB_MAX_STOR_DEV) {
+		printf("max USB Storage Device reached: %d stopping\n",
+		       usb_max_devs);
+		return -ENOSPC;
+	}
+
 	debug("\n\nProbing for storage\n");
 	if (usb_storage_probe(dev, 0, &usb_stor[usb_max_devs])) {
 		/* OK, it's a storage device.  Iterate over its LUNs
@@ -210,13 +217,6 @@ static int usb_stor_probe_device(struct usb_device *dev)
 		}
 	}
 
-	/* if storage device */
-	if (usb_max_devs == USB_MAX_STOR_DEV) {
-		printf("max USB Storage Device reached: %d stopping\n",
-		       usb_max_devs);
-		return -ENOSPC;
-	}
-
 	return 0;
 }