ath10k: sanitity check for ep connectivity
Function ep_rx_complete is being called without NULL checking in ath10k_htc_rx_completion_handler. Without such check, mal- formed packet is able to cause jump to NULL. ep->service_id seems a good candidate for sanity check as it is used in usb.c. Signed-off-by:Zekun Shen <bruceshenzk@gmail.com> Signed-off-by:
Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200622022055.16028-1-bruceshenzk@gmail.com
Loading
Please sign in to comment