From 37a5e120118afaef5ca36f2127f23edac644c99a Mon Sep 17 00:00:00 2001 From: Subasri S Date: Sun, 2 Aug 2026 11:59:24 +0530 Subject: [PATCH] usb: atm: ueagle-atm: fix array-index-out-of-bounds in uea_bind() Add a bounds check on the global variable modem_index before using it as an index in sync_wait[] array whose size is NB_MODEM. Cc: stable+noautosel@kernel.org # untested fix to a driver init path race Reported-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com Tested-by: syzbot+92f5bf49bf4ac75223ca@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=92f5bf49bf4ac75223ca Signed-off-by: Subasri S Link: https://patch.msgid.link/20260802-usb-ueagble-atm-v1-1-340f085b04aa@gmail.com Signed-off-by: Jakub Kicinski --- drivers/usb/atm/ueagle-atm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c index 4266a0cb7e3b..61723e7ab351 100644 --- a/drivers/usb/atm/ueagle-atm.c +++ b/drivers/usb/atm/ueagle-atm.c @@ -2463,7 +2463,8 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf, if (ifnum != UEA_INTR_IFACE_NO) return -ENODEV; - usbatm->flags = (sync_wait[modem_index] ? 0 : UDSL_SKIP_HEAVY_INIT); + usbatm->flags = (modem_index < NB_MODEM && sync_wait[modem_index]) ? + 0 : UDSL_SKIP_HEAVY_INIT; /* interface 1 is for outbound traffic */ ret = claim_interface(usb, usbatm, UEA_US_IFACE_NO);