Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c1add35 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

net: lan78xx: add missing endpoint sanity check 



[ Upstream commit 8d8e95fd6d69d774013f51e5f2ee10c6e6d1fc14 ]

Add the missing endpoint sanity check to prevent a NULL-pointer
dereference should a malicious device lack the expected endpoints.

Note that the driver has a broken endpoint-lookup helper,
lan78xx_get_endpoints(), which can end up accepting interfaces in an
altsetting without endpoints as long as *some* altsetting has a bulk-in
and a bulk-out endpoint.

Fixes: 55d7de9d ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ee9599af

drivers/net/usb/lan78xx.c

+5 −0
Original line number Diff line number Diff line
@@ -3786,6 +3786,11 @@ static int lan78xx_probe(struct usb_interface *intf, 
	netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;

	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);



	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {

		ret = -ENODEV;

		goto out3;

	}



	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;

	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;

	dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;