CVE-2022-49551

In the Linux kernel, the following vulnerability has been resolved:

usb: isp1760: Fix out-of-bounds array access

Running the driver through kasan gives an interesting splat:

BUG: KASAN: global-out-of-bounds in isp1760register+0x180/0x70c Read of size 20 at addr f1db2e64 by task swapper/0/1 (...) isp1760register from isp1760platprobe+0x1d8/0x220 (...)

This happens because the loop reading the regmap fields for the different ISP1760 variants look like this:

for (i = 0; i < HCFIELDMAX; i++) { ... }

Meaning it expects the arrays to be at least HCFIELDMAX - 1 long.

However the arrays isp1760hcregfields[], isp1763hcregfields[], isp1763hcvolatileranges[] and isp1763dcvolatileranges[] are dynamically sized during compilation.

Fix this by putting an empty assignment to the [HCFIELDMAX] and [DCFIELDMAX] array member at the end of each array. This will make the array one member longer than it needs to be, but avoids the risk of overwriting whatever is inside [HCFIELDMAX - 1] and is simple and intuitive to read. Also add comments explaining what is going on.