[PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind()
From: Subasri S <hidden>
Date: 2026-08-02 06:29:38
Also in:
linux-usb, lkml
Subsystem:
atm, ikanos/adi eagle adsl usb driver, the rest, usb subsystem · Maintainers:
Chas Williams, Matthieu Castet, Stanislaw Gruszka, Linus Torvalds, Greg Kroah-Hartman
Add a bounds check on the global variable modem_index before using it as an index in sync_wait[] array whose size is NB_MODEM. Reported-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com Tested-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=92f5bf49bf4ac75223ca Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver") Signed-off-by: Subasri S <redacted> --- drivers/usb/atm/ueagle-atm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index 4266a0cb7e3b..61723e7ab351 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c@@ -2463,7 +2463,8 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf, if (ifnum != UEA_INTR_IFACE_NO) return -ENODEV; - usbatm->flags = (sync_wait[modem_index] ? 0 : UDSL_SKIP_HEAVY_INIT); + usbatm->flags = (modem_index < NB_MODEM && sync_wait[modem_index]) ? + 0 : UDSL_SKIP_HEAVY_INIT; /* interface 1 is for outbound traffic */ ret = claim_interface(usb, usbatm, UEA_US_IFACE_NO);
--- base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff change-id: 20260802-usb-ueagble-atm-ca29d2bd4189 Best regards, -- Subasri S [off-list ref]