Johan Hovold 4ce362711d uwb: i1480-dfu: fix NULL-deref at probe ...

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Note that the dereference happens in the cmd and wait_init_done
callbacks which are called during probe.

Fixes: 1ba47da52712 ("uwb: add the i1480 DFU driver")
Cc: stable <stable@vger.kernel.org>     # 2.6.28
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Cc: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-03-14 17:07:31 +08:00

..

i1480

uwb: i1480-dfu: fix NULL-deref at probe

2017-03-14 17:07:31 +08:00

address.c

uwb: use '%pM' format to print MAC address

2010-10-22 10:21:40 -07:00

allocator.c

uwb: use for_each_clear_bit()

2012-03-23 16:58:34 -07:00

beacon.c

uwb: fix variable set but not used warnings

2014-05-27 15:18:48 -07:00

driver.c

uwb: create a uwb bus type and add in-range peer devices to it

2014-09-23 22:04:44 -07:00

drp-avail.c

uwb: improved MAS allocator and reservation conflict handling

2008-12-12 13:00:06 +00:00

drp-ie.c

uwb: Staticize local symbols

2013-08-19 17:08:16 -07:00

drp.c

uwb: drp: Use setup_timer

2015-10-24 19:52:53 -07:00

est.c

uwb: fix variable set but not used warnings

2014-05-27 15:18:48 -07:00

hwa-rc.c

uwb: hwa-rc: fix NULL-deref at probe

2017-03-14 17:07:30 +08:00

ie-rcv.c

uwb: fix variable set but not used warnings

2014-05-27 15:18:48 -07:00

ie.c

uwb: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required

2011-10-31 19:32:19 -04:00

Kconfig

uwb: remove UWB build dependency on PCI

2014-09-23 22:04:44 -07:00

lc-dev.c

uwb: lc-dev: Remove unused function

2015-01-25 20:48:28 +08:00

lc-rc.c

uwb: fix device reference leaks

2016-11-01 09:04:04 -06:00

Makefile

uwb: Remove the WLP subsystem and drivers

2010-10-25 14:03:45 +01:00

neh.c

uwb: neh: Use setup_timer

2015-10-24 19:52:53 -07:00

pal.c

uwb: fix device reference leaks

2016-11-01 09:04:04 -06:00

radio.c

uwb: comment typo fix

2014-05-27 15:18:48 -07:00

reset.c

uwb: fix uwb_dev_unlock() missed at an error path in uwb_rc_cmd_async()

2012-11-26 15:58:43 -08:00

rsv.c

uwb: rsv: Use setup_timer

2015-10-24 19:52:53 -07:00

scan.c

drivers/uwb: fix implicit use of stat.h

2011-10-31 19:32:18 -04:00

umc-bus.c

uwb: Remove umc bus legacy suspend/resume support

2015-03-18 17:27:03 +01:00

umc-dev.c

uwb: umc-dev: add missing put_device call

2013-12-19 10:26:46 -08:00

umc-drv.c

uwb: Add export.h for EXPORT_SYMBOL/THIS_MODULE as required

2011-10-31 19:32:19 -04:00

uwb-debug.c

debugfs: Pass bool pointer to debugfs_create_bool()

2015-10-04 11:36:07 +01:00

uwb-internal.h

uwb: create a uwb bus type and add in-range peer devices to it

2014-09-23 22:04:44 -07:00

uwbd.c

uwb: uwbd() is not freezable kthread

2015-12-01 14:26:33 -08:00

whc-rc.c

treewide: Convert uses of struct resource to resource_size(ptr)

2011-06-10 14:55:36 +02:00

whci.c

uwb/whci: Delete an unnecessary check before the function call "umc_device_unregister"

2015-03-18 16:56:40 +01:00