* [PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind()
@ 2026-08-02 6:29 Subasri S
2026-08-06 15:50 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Subasri S @ 2026-08-02 6:29 UTC (permalink / raw)
To: Matthieu CASTET, Stanislaw Gruszka, Chas Williams,
Greg Kroah-Hartman, Andrew Morton
Cc: Greg Kroah-Hartman, linux-atm-general, netdev, linux-usb,
linux-kernel, syzbot+92f5bf49bf4ac75223ca, Subasri S
Add a bounds check on the global variable modem_index before
using it as an index in sync_wait[] array whose size is NB_MODEM.
Reported-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com
Tested-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=92f5bf49bf4ac75223ca
Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver")
Signed-off-by: Subasri S <subasris1210@gmail.com>
---
drivers/usb/atm/ueagle-atm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index 4266a0cb7e3b..61723e7ab351 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -2463,7 +2463,8 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf,
if (ifnum != UEA_INTR_IFACE_NO)
return -ENODEV;
- usbatm->flags = (sync_wait[modem_index] ? 0 : UDSL_SKIP_HEAVY_INIT);
+ usbatm->flags = (modem_index < NB_MODEM && sync_wait[modem_index]) ?
+ 0 : UDSL_SKIP_HEAVY_INIT;
/* interface 1 is for outbound traffic */
ret = claim_interface(usb, usbatm, UEA_US_IFACE_NO);
---
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
change-id: 20260802-usb-ueagble-atm-ca29d2bd4189
Best regards,
--
Subasri S <subasris1210@gmail.com>
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind()
2026-08-02 6:29 [PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind() Subasri S
@ 2026-08-06 15:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-08-06 15:50 UTC (permalink / raw)
To: Subasri S
Cc: castet.matthieu, stf_xl, 3chas3, gregkh, akpm, gregkh,
linux-atm-general, netdev, linux-usb, linux-kernel,
syzbot+92f5bf49bf4ac75223ca
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Sun, 02 Aug 2026 11:59:24 +0530 you wrote:
> Add a bounds check on the global variable modem_index before
> using it as an index in sync_wait[] array whose size is NB_MODEM.
>
> Reported-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com
> Tested-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=92f5bf49bf4ac75223ca
> Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver")
> Signed-off-by: Subasri S <subasris1210@gmail.com>
>
> [...]
Here is the summary with links:
- usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind()
https://git.kernel.org/netdev/net-next/c/37a5e120118a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-06 15:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-02 6:29 [PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind() Subasri S
2026-08-06 15:50 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox