netdev - Re: Re^2:: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 20 Aug 2015 09:16:31 +0200
From:	Bjørn Mork <bjorn@...k.no>
To:	Vivek Kumar Bhagat <vivek.bhagat@...sung.com>
Cc:	"netdev\@vger.kernel.org" <netdev@...r.kernel.org>,
	Nitin Jhanwar <nitin.j@...sung.com>,
	HEMANSHU SRIVASTAVA <hemanshu.s@...sung.com>
Subject: Re: Re^2:: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

Vivek Kumar Bhagat <vivek.bhagat@...sung.com> writes:

> Dear Bjorn,
>
>>> This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
>>> being called with a NULL skb.
> I am using ax88179_178a driver and not familiar with usbnet minidrivers.
> When ax88179_tx_fixup() is called with NULL skb from
> usbnet_start_xmit(), I get a kernel crash.
>     Backtrace:
>     09:14:569>[0-553.5598] [<befaa194>] (ax88179_tx_fixup+0x0/0x16c [ax88179_178a]) from [<befef7a8>] (usbnet_start_xmit+0xa
>     09:14:569>0/0x420 [usbnet])
>     09:14:570>[0-553.5711]  r6:cb5ec280 r5:00000000 r4:cb5ebd40
>     09:14:572>[0-553.5755] [<befef708>] (usbnet_start_xmit+0x0/0x420 [usbnet]) from [<c0400040>] (dev_hard_start_xmit+0x2ec/
>     09:14:572>0x558)
>     09:14:572>[0-553.5858] [<c03ffd54>] (dev_hard_start_xmit+0x0/0x558)
> In case skb NULL check can not be added in usbnet_start_xmit()
> then NULL check is required in ax88179_tx_fixup() or asix_tx_fixup().

Yes.

Or you could add the check to usbnet_start_xmit() if you remove the ugly
hack in the minidrivers calling usbnet_start_xmit with skb == NULL first.
This is cdc_ncm and those depending on cdc_ncm.

But it would also be interesting to know why ax88179_tx_fixup() is
called with a NULL skb. I believe this should not happen.  Do you have
any idea?

cdc_ncm, which is the driver depending on the NULL skb input, will
explicitly call
  usbnet_start_xmit(NULL, dev->net);

I don't know any other way this could happen.



Bjørn
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html