commit a23b64845f1ed0c090e30a70ca747a379674e006
author David Vrabel <david.vrabel@csr.com> Mon Mar 22 14:50:14 2010 +0000
committer Greg Kroah-Hartman <gregkh@suse.de> Thu Apr 22 15:18:22 2010 -0700
tree 603bf71c16284622eb6e53cb51cb996fa5ab7b6b
parent 18f91196b6e7994bd694a96a6c3b0ac1f3e81d82

usb: wusb: don't overflow the Keep Alive IE buffer

The Keep Alive IE only has space for WUIE_ELT_MAX (== 4) device addresses.

Signed-off-by: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

drivers/usb/wusbcore/devconnect.c

diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 46e79d3..7ec24e4 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -438,7 +438,7 @@
 	old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
 	keep_alives = 0;
 	for (cnt = 0;
-	     keep_alives <= WUIE_ELT_MAX && cnt < wusbhc->ports_max;
+	     keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
 	     cnt++) {
 		unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);