linux-kernel - Re: A potential bug in drivers/usb/gadget/udc/m66592-udc.ko

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 08 Sep 2016 15:04:15 +0300
From:   Felipe Balbi <felipe.balbi@...ux.intel.com>
To:     Pavel Andrianov <andrianov@...ras.ru>
Cc:     Michal Nazarewicz <mina86@...a86.com>,
        linux-kernel@...r.kernel.org, ldv-project@...uxtesting.org,
        Vaishali Thakkar <vaishali.thakkar@...cle.com>
Subject: Re: A potential bug in drivers/usb/gadget/udc/m66592-udc.ko


Hi,

Pavel Andrianov <andrianov@...ras.ru> writes:
> Hi!
>
> There is a potential bug in drivers/usb/gadget/udc/m66592-udc.ko.
> In m66592_probe interrupts are requested at line 1612. After that 
> initialization of common resources is continued. For example, in
>
> -> usb_add_gadget_udc (line 1678)
>    -> usb_add_gadget_udc_release
>      -> udc_bind_to_driver
>        -> usb_gadget_udc_start
>          -> m66592_udc_start
>
> m66592->driver is set. In interrupt handler the data is used, thus if 
> interrupt comes before udc_start is executed, null pointer dereference 
> occurs.
> Should the call of request_irq be after complete initialization?

interrupts will only fire after we connect data pullups, that's done by
->pullup() method waaaaaaaay later ;-)

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (801 bytes)