From c89e79d4199cf76f3a018c230d5705df7d2225c6 Mon Sep 17 00:00:00 2001 From: Simon Glass Date: Mon, 29 Feb 2016 15:25:53 -0700 Subject: dm: usb: Avoid exceeding available array size for storage devices The limit on storage devices is USB_MAX_STOR_DEV but we use one extra element while probing to see if a device is a storage device. Avoid this, since it causes memory corruption. Signed-off-by: Simon Glass Reviewed-by: Marek Vasut Tested-by: Stephen Warren --- common/usb_storage.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'common') diff --git a/common/usb_storage.c b/common/usb_storage.c index 60531e2..f2d2ad9 100644 --- a/common/usb_storage.c +++ b/common/usb_storage.c @@ -176,6 +176,13 @@ static int usb_stor_probe_device(struct usb_device *dev) if (dev == NULL) return -ENOENT; /* no more devices available */ + /* We don't have space to even probe if we hit the maximum */ + if (usb_max_devs == USB_MAX_STOR_DEV) { + printf("max USB Storage Device reached: %d stopping\n", + usb_max_devs); + return -ENOSPC; + } + debug("\n\nProbing for storage\n"); if (usb_storage_probe(dev, 0, &usb_stor[usb_max_devs])) { /* OK, it's a storage device. Iterate over its LUNs @@ -210,13 +217,6 @@ static int usb_stor_probe_device(struct usb_device *dev) } } - /* if storage device */ - if (usb_max_devs == USB_MAX_STOR_DEV) { - printf("max USB Storage Device reached: %d stopping\n", - usb_max_devs); - return -ENOSPC; - } - return 0; } -- cgit v1.1