1 files changed, 27 insertions, 10 deletions

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 02de3110fe94..475723c006f9 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -764,29 +764,39 @@ static int usb_serial_probe(struct usb_interface *interface,
                 if (usb_endpoint_is_bulk_in(endpoint)) {
                         /* we found a bulk in endpoint */
                         dev_dbg(ddev, "found bulk in on endpoint %d\n", i);
-                        bulk_in_endpoint[num_bulk_in] = endpoint;
-                        ++num_bulk_in;
+                        if (num_bulk_in < MAX_NUM_PORTS) {
+                                bulk_in_endpoint[num_bulk_in] = endpoint;
+                                ++num_bulk_in;
+                        }
                 }
 
                 if (usb_endpoint_is_bulk_out(endpoint)) {
                         /* we found a bulk out endpoint */
                         dev_dbg(ddev, "found bulk out on endpoint %d\n", i);
-                        bulk_out_endpoint[num_bulk_out] = endpoint;
-                        ++num_bulk_out;
+                        if (num_bulk_out < MAX_NUM_PORTS) {
+                                bulk_out_endpoint[num_bulk_out] = endpoint;
+                                ++num_bulk_out;
+                        }
                 }
 
                 if (usb_endpoint_is_int_in(endpoint)) {
                         /* we found a interrupt in endpoint */
                         dev_dbg(ddev, "found interrupt in on endpoint %d\n", i);
-                        interrupt_in_endpoint[num_interrupt_in] = endpoint;
-                        ++num_interrupt_in;
+                        if (num_interrupt_in < MAX_NUM_PORTS) {
+                                interrupt_in_endpoint[num_interrupt_in] =
+                                                endpoint;
+                                ++num_interrupt_in;
+                        }
                 }
 
                 if (usb_endpoint_is_int_out(endpoint)) {
                         /* we found an interrupt out endpoint */
                         dev_dbg(ddev, "found interrupt out on endpoint %d\n", i);
-                        interrupt_out_endpoint[num_interrupt_out] = endpoint;
-                        ++num_interrupt_out;
+                        if (num_interrupt_out < MAX_NUM_PORTS) {
+                                interrupt_out_endpoint[num_interrupt_out] =
+                                                endpoint;
+                                ++num_interrupt_out;
+                        }
                 }
         }
 
@@ -809,8 +819,10 @@ static int usb_serial_probe(struct usb_interface *interface,
                                 if (usb_endpoint_is_int_in(endpoint)) {
                                         /* we found a interrupt in endpoint */
                                         dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n");
-                                        interrupt_in_endpoint[num_interrupt_in] = endpoint;
-                                        ++num_interrupt_in;
+                                        if (num_interrupt_in < MAX_NUM_PORTS) {
+                                                interrupt_in_endpoint[num_interrupt_in] = endpoint;
+                                                ++num_interrupt_in;
+                                        }
                                 }
                         }
                 }
@@ -850,6 +862,11 @@ static int usb_serial_probe(struct usb_interface *interface,
                         num_ports = type->num_ports;
         }
 
+        if (num_ports > MAX_NUM_PORTS) {
+                dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+                num_ports = MAX_NUM_PORTS;
+        }
+
         serial->num_ports = num_ports;
         serial->num_bulk_in = num_bulk_in;
         serial->num_bulk_out = num_bulk_out;