linux-kernel - [PATCH] net: usb: ax88179_178a: avoid writing the mac address before first reading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Apr 2024 11:55:49 +0200
From: Jose Ignacio Tornos Martinez <jtornosm@...hat.com>
To: davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	linux-usb@...r.kernel.org,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Jose Ignacio Tornos Martinez <jtornosm@...hat.com>,
	stable@...r.kernel.org,
	Jarkko Palviainen <jarkko.palviainen@...il.com>
Subject: [PATCH] net: usb: ax88179_178a: avoid writing the mac address before first reading

After the commit d2689b6a86b9 ("net: usb: ax88179_178a: avoid two
consecutive device resets"), reset operation, in which the default mac
address from the device is read, is not executed from bind operation and
the random address, that is pregenerated just in case, is direclty written
the first time in the device, so the default one from the device is not
even read. This writing is not dangerous because is volatile and the
default mac address is not missed.

In order to avoid this, do not allow writing a mac address directly into
the device, if the default mac address from the device has not been read
yet.

cc: stable@...r.kernel.org # 6.6+
Fixes: d2689b6a86b9 ("net: usb: ax88179_178a: avoid two consecutive device resets")
Reported-by: Jarkko Palviainen <jarkko.palviainen@...il.com>
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@...hat.com>
---
 drivers/net/usb/ax88179_178a.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 69169842fa2f..650bb7b6badf 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -174,6 +174,7 @@ struct ax88179_data {
 	u32 wol_supported;
 	u32 wolopts;
 	u8 disconnecting;
+	u8 mac_address_read;
 };
 
 struct ax88179_int_data {
@@ -969,9 +970,12 @@ static int ax88179_change_mtu(struct net_device *net, int new_mtu)
 static int ax88179_set_mac_addr(struct net_device *net, void *p)
 {
 	struct usbnet *dev = netdev_priv(net);
+	struct ax88179_data *ax179_data = dev->driver_priv;
 	struct sockaddr *addr = p;
 	int ret;
 
+	if (!ax179_data->mac_address_read)
+		return -EAGAIN;
 	if (netif_running(net))
 		return -EBUSY;
 	if (!is_valid_ether_addr(addr->sa_data))
@@ -1256,6 +1260,7 @@ static int ax88179_led_setting(struct usbnet *dev)
 
 static void ax88179_get_mac_addr(struct usbnet *dev)
 {
+	struct ax88179_data *ax179_data = dev->driver_priv;
 	u8 mac[ETH_ALEN];
 
 	memset(mac, 0, sizeof(mac));
@@ -1281,6 +1286,9 @@ static void ax88179_get_mac_addr(struct usbnet *dev)
 
 	ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, ETH_ALEN,
 			  dev->net->dev_addr);
+
+	ax179_data->mac_address_read = 1;
+	netdev_info(dev->net, "MAC address: %pM\n", dev->net->dev_addr);
 }
 
 static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
-- 
2.44.0