linux-kernel - Re: [PATCH] aspeed-vhub: epn: fix an incorrect member check on list iterator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YmKmysEfb9GY5ng4@kroah.com>
Date:   Fri, 22 Apr 2022 14:59:54 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Xiaomeng Tong <xiam0nd.tong@...il.com>
Cc:     balbi@...nel.org, joel@....id.au, andrew@...id.au,
        rentao.bupt@...il.com, caihuoqing@...du.com,
        benh@...nel.crashing.org, linux-usb@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        linux-aspeed@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] aspeed-vhub: epn: fix an incorrect member check on list
 iterator

On Sun, Mar 27, 2022 at 02:24:31PM +0800, Xiaomeng Tong wrote:
> The bug is here:
> 	if (&req->req == u_req) {
> 
> The list iterator 'req' will point to a bogus position containing
> HEAD if the list is empty or no element is found. This case must
> be checked before any use of the iterator, otherwise it may bypass
> the 'if (&req->req == u_req) {' check in theory, if '*u_req' obj is
> just allocated in the same addr with '&req->req'.
> 
> To fix this bug, just mova all thing inside the loop and return 0,
> otherwise return error.
> 
> Cc: stable@...r.kernel.org
> Fixes: 7ecca2a4080cb ("usb/gadget: Add driver for Aspeed SoC virtual hub")
> Signed-off-by: Xiaomeng Tong <xiam0nd.tong@...il.com>
> ---
>  drivers/usb/gadget/udc/aspeed-vhub/epn.c | 23 ++++++++++-------------
>  1 file changed, 10 insertions(+), 13 deletions(-)

Does not apply anymore :(