linux-kernel - [PATCH v2 2/9] can: esd_usb: esd_usb_disconnect(): fix NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221210090157.793547-3-mailhol.vincent@wanadoo.fr>
Date:   Sat, 10 Dec 2022 18:01:50 +0900
From:   Vincent Mailhol <mailhol.vincent@...adoo.fr>
To:     Marc Kleine-Budde <mkl@...gutronix.de>, linux-can@...r.kernel.org
Cc:     Oliver Neukum <oneukum@...e.com>,
        Wolfgang Grandegger <wg@...ndegger.com>,
        "David S . Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Frank Jungclaus <frank.jungclaus@....eu>, socketcan@....eu,
        Yasushi SHOJI <yashi@...cecubics.com>,
        Stefan Mätje <stefan.maetje@....eu>,
        Hangyu Hua <hbh25y@...il.com>,
        Oliver Hartkopp <socketcan@...tkopp.net>,
        Peter Fink <pfink@...ist-es.de>,
        Jeroen Hofstee <jhofstee@...tronenergy.com>,
        Christoph Möhring <cmoehring@...ist-es.de>,
        John Whittington <git@...engineering.co.uk>,
        Vasanth Sadhasivan <vasanth.sadhasivan@...sara.com>,
        Jimmy Assarsson <extja@...ser.com>,
        Anssi Hannula <anssi.hannula@...wise.fi>,
        Pavel Skripkin <paskripkin@...il.com>,
        Stephane Grosjean <s.grosjean@...k-system.com>,
        Wolfram Sang <wsa+renesas@...g-engineering.com>,
        "Gustavo A . R . Silva" <gustavoars@...nel.org>,
        Julia Lawall <Julia.Lawall@...ia.fr>,
        Dongliang Mu <dzm91@...t.edu.cn>,
        Sebastian Haas <haas@...-wuensche.com>,
        Maximilian Schneider <max@...neidersoft.net>,
        Daniel Berglund <db@...ser.com>,
        Olivier Sobrie <olivier@...rie.be>,
        Remigiusz Kołłątaj 
        <remigiusz.kollataj@...ica.com>,
        Jakob Unterwurzacher <jakob.unterwurzacher@...obroma-systems.com>,
        Martin Elshuber <martin.elshuber@...obroma-systems.com>,
        Bernd Krumboeck <b.krumboeck@...il.com>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        Alan Stern <stern@...land.harvard.edu>,
        linux-usb@...r.kernel.org,
        Vincent Mailhol <mailhol.vincent@...adoo.fr>
Subject: [PATCH v2 2/9] can: esd_usb: esd_usb_disconnect(): fix NULL pointer dereference

esd_usb sets the driver's priv data to NULL before waiting for the
completion of outsdanding urbs. This can results in NULL pointer
dereference, c.f. [1] and [2].

Remove the call to usb_set_intfdata(intf, NULL). The core will take
care of setting it to NULL after esd_usb_disconnect() at [3].

[1] c/27ef17849779 ("usb: add usb_set_intfdata() documentation")
Link: https://git.kernel.org/gregkh/usb/c/27ef17849779

[2] thread about usb_set_intfdata() on linux-usb mailing.
Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/

[3] function usb_unbind_interface() from drivers/usb/core/driver.c
Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Signed-off-by: Vincent Mailhol <mailhol.vincent@...adoo.fr>
---
@stable team: the file was renamed from esd_usb2.c to esd_usb.c in [4].

[4] 5e910bdedc84 ("can/esd_usb2: Rename esd_usb2.c to esd_usb.c")
---
 drivers/net/can/usb/esd_usb.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
index 81b88e9e5bdc..f3006c6dc5d6 100644
--- a/drivers/net/can/usb/esd_usb.c
+++ b/drivers/net/can/usb/esd_usb.c
@@ -1127,8 +1127,6 @@ static void esd_usb_disconnect(struct usb_interface *intf)
 	device_remove_file(&intf->dev, &dev_attr_hardware);
 	device_remove_file(&intf->dev, &dev_attr_nets);
 
-	usb_set_intfdata(intf, NULL);
-
 	if (dev) {
 		for (i = 0; i < dev->net_count; i++) {
 			if (dev->nets[i]) {
-- 
2.37.4