Messages in this thread Patch in this message | | | From | Edward Adam Davis <> | Subject | Re: [syzbot] [wireless?] [usb?] UBSAN: array-index-out-of-bounds in htc_issue_send | Date | Thu, 21 Mar 2024 11:18:42 +0800 |
| |
please test oob in htc_issue_send
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index eb631fd3336d..0d1115d1cc29 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -295,6 +295,9 @@ int htc_connect_service(struct htc_target *target, } *conn_rsp_epid = target->conn_rsp_epid; + if (*conn_rsp_epid < 0 || *conn_rsp_epid > ENDPOINT_MAX) + return -EINVAL; + return 0; err: kfree_skb(skb);
| |