]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: wimax/i2400m: fix NULL-deref at probe
authorJohan Hovold <johan@kernel.org>
Mon, 13 Mar 2017 12:42:03 +0000 (13:42 +0100)
committerSasha Levin <alexander.levin@microsoft.com>
Wed, 17 Jan 2018 17:55:34 +0000 (12:55 -0500)
commit978a56a324ad7e5e52ccbaa5bff2ab76ca4dcb4f
tree0baa4b824c7b535fb829537a67772c9cc823064f
parent6f7feb80d24c956b3f3c731a7dec11b6650dae92
net: wimax/i2400m: fix NULL-deref at probe

[ Upstream commit 6e526fdff7be4f13b24f929a04c0e9ae6761291e ]

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

The endpoints are specifically dereferenced in the i2400m_bootrom_init
path during probe (e.g. in i2400mu_tx_bulk_out).

Fixes: f398e4240fce ("i2400m/USB: probe/disconnect, dev init/shutdown
and reset backends")
Cc: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
drivers/net/wimax/i2400m/usb.c