linux-kernel - Re: [PATCH v3] ieee802154: atusb: fix uninit value in atusb_set_extended

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3b35da92-0468-cc08-b7aa-d9d52af74291@datenfreihafen.org>
Date:   Tue, 4 Jan 2022 20:25:16 +0100
From:   Stefan Schmidt <stefan@...enfreihafen.org>
To:     Alexander Aring <aahringo@...hat.com>,
        Pavel Skripkin <paskripkin@...il.com>
Cc:     alex.aring@...il.com, davem@...emloft.net,
        Jakub Kicinski <kuba@...nel.org>, linux-wpan@...r.kernel.org,
        Network Development <netdev@...r.kernel.org>,
        linux-kernel@...r.kernel.org,
        Alexander Potapenko <glider@...gle.com>
Subject: Re: [PATCH v3] ieee802154: atusb: fix uninit value in
 atusb_set_extended_addr

Hello.

On 04.01.22 19:57, Alexander Aring wrote:
> Hi,
> 
> On Tue, Jan 4, 2022 at 1:28 PM Pavel Skripkin <paskripkin@...il.com> wrote:
>>
>> Alexander reported a use of uninitialized value in
>> atusb_set_extended_addr(), that is caused by reading 0 bytes via
>> usb_control_msg().
>>
>> Fix it by validating if the number of bytes transferred is actually
>> correct, since usb_control_msg() may read less bytes, than was requested
>> by caller.
>>
>> Fail log:
>>
>> BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]
>> BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]
>> BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056
>> Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd
>>   ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]
>>   atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]
>>   atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056
>>   usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
>>
>> Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
>> Reported-by: Alexander Potapenko <glider@...gle.com>
>> Acked-by: Alexander Aring <aahringo@...hat.com>
>> Signed-off-by: Pavel Skripkin <paskripkin@...il.com>
>> ---
>>
>> Changes in v3:
>>          - Changed atusb_control_msg() to usb_control_msg() in
>>            atusb_get_and_show_build(), since request there may read various length
>>            data
>>
> 
> Thanks for catching this.

Test passed my testing.


This patch has been applied to the wpan tree and will be
part of the next pull request to net. Thanks!

regards
Stefan Schmidt