diff options
| author | David S. Miller <davem@davemloft.net> | 2018-12-20 21:53:28 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-12-20 22:53:36 +0300 |
| commit | 2be09de7d6a06f58e768de1255a687c9aaa66606 (patch) | |
| tree | 298f9e04caf105873d987e807eccba27710a49cc /drivers/net/usb/hso.c | |
| parent | 44a7b3b6e3a458f9549c2cc28e74ecdc470e42f1 (diff) | |
| parent | 1d51b4b1d3f2db0d6d144175e31a84e472fbd99a (diff) | |
| download | linux-2be09de7d6a06f58e768de1255a687c9aaa66606.tar.xz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Lots of conflicts, by happily all cases of overlapping
changes, parallel adds, things of that nature.
Thanks to Stephen Rothwell, Saeed Mahameed, and others
for their guidance in these resolutions.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/usb/hso.c')
| -rw-r--r-- | drivers/net/usb/hso.c | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 184c24baca15..d6916f787fce 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface) return -EIO; } + /* check if we have a valid interface */ + if (if_num > 16) { + kfree(config_data); + return -EINVAL; + } + switch (config_data[if_num]) { case 0x0: result = 0; @@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface, /* Get the interface/port specification from either driver_info or from * the device itself */ - if (id->driver_info) + if (id->driver_info) { + /* if_num is controlled by the device, driver_info is a 0 terminated + * array. Make sure, the access is in bounds! */ + for (i = 0; i <= if_num; ++i) + if (((u32 *)(id->driver_info))[i] == 0) + goto exit; port_spec = ((u32 *)(id->driver_info))[if_num]; - else + } else { port_spec = hso_get_config_data(interface); + if (port_spec < 0) + goto exit; + } /* Check if we need to switch to alt interfaces prior to port * configuration */ |