Merge tag 'usb-serial-4.19-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git...

Johan writes:

USB-serial fixes for v4.19-rc3

Here are two fixes for array-underflow bugs in completion handlers due
to insufficient sanity checks.

All have been in linux-next with no reported issues.

Signed-off-by: Johan Hovold <johan@kernel.org>

diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h
index e53c682610176bf694e3130031181d669e3b83fa..9bbcee37524e56ccf7e9473b23c271924bedaf7d 100644 (file)
--- a/drivers/usb/serial/io_ti.h
+++ b/drivers/usb/serial/io_ti.h
@@ -173,7 +173,7 @@ struct ump_interrupt {
 }  __attribute__((packed));
 
 
-#define TIUMP_GET_PORT_FROM_CODE(c)    (((c) >> 4) - 3)
+#define TIUMP_GET_PORT_FROM_CODE(c)    (((c) >> 6) & 0x01)
 #define TIUMP_GET_FUNC_FROM_CODE(c)    ((c) & 0x0f)
 #define TIUMP_INTERRUPT_CODE_LSR       0x03
 #define TIUMP_INTERRUPT_CODE_MSR       0x04

diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 3010878f7f8ed9004bb78a15f63e1eb83261742e..e3c5832337e0bdbb83df78285a697ac5f5a8af3f 100644 (file)
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1119,7 +1119,7 @@ static void ti_break(struct tty_struct *tty, int break_state)
 
 static int ti_get_port_from_code(unsigned char code)
 {
-       return (code >> 4) - 3;
+       return (code >> 6) & 0x01;
 }
 
 static int ti_get_func_from_code(unsigned char code)