| From c2d4e3ad620f06f2e08804ae8c5a7993d97d4abf Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 14 Jan 2020 09:27:29 +0100 |
| Subject: [PATCH] r8152: add missing endpoint sanity check |
| |
| commit 86f3f4cd53707ceeec079b83205c8d3c756eca93 upstream. |
| |
| Add missing endpoint sanity check to probe in order to prevent a |
| NULL-pointer dereference (or slab out-of-bounds access) when retrieving |
| the interrupt-endpoint bInterval on ndo_open() in case a device lacks |
| the expected endpoints. |
| |
| Fixes: 40a82917b1d3 ("net/usb/r8152: enable interrupt transfer") |
| Cc: hayeswang <hayeswang@realtek.com> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c |
| index 19bf63f73688..cdd42b89732f 100644 |
| --- a/drivers/net/usb/r8152.c |
| +++ b/drivers/net/usb/r8152.c |
| @@ -5195,6 +5195,9 @@ static int rtl8152_probe(struct usb_interface *intf, |
| return -ENODEV; |
| } |
| |
| + if (intf->cur_altsetting->desc.bNumEndpoints < 3) |
| + return -ENODEV; |
| + |
| usb_reset_device(udev); |
| netdev = alloc_etherdev(sizeof(struct r8152)); |
| if (!netdev) { |
| -- |
| 2.7.4 |
| |
