netdev - Re: usbnet: fix oops in usbnet_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <25431888.4WZyYrK8zN@linux-lqwf.site>
Date:	Thu, 06 Sep 2012 15:10:51 +0200
From:	Oliver Neukum <oneukum@...e.de>
To:	Dan Carpenter <dan.carpenter@...cle.com>
Cc:	khlebnikov@...nvz.org, netdev@...r.kernel.org,
	linux-usb@...r.kernel.org
Subject: Re: usbnet: fix oops in usbnet_start_xmit

On Thursday 06 September 2012 05:52:30 Dan Carpenter wrote:
> I sent this email a year ago when the patch was committed but I
> never received a response.

I probably should have checked then.

> regards,
> dan carpenter
> 
> On Wed, Nov 09, 2011 at 10:34:59AM +0300, Dan Carpenter wrote:
> > Hello Konstantin Khlebnikov,
> > 
> > This is a semi-automatic email about new static checker warnings.
> > 
> > The patch 23ba07991dad: "usbnet: fix oops in usbnet_start_xmit" from 
> > Nov 7, 2011, leads to the following Smatch complaint:
> > 
> > drivers/net/usb/usbnet.c +1077 usbnet_start_xmit()
> >        error: we previously assumed 'skb' could be null (see line 1060)
> > 
> > drivers/net/usb/usbnet.c
> >   1059        
> >   1060                if (skb)
> >                     ^^^
> > check introduced here.
> > 
> >   1061                        skb_tx_timestamp(skb);
> >   1062        
> >   1063                // some devices want funky USB-level framing, for
> >   1064                // win32 driver (usually) and/or hardware quirks
> >   1065                if (info->tx_fixup) {
> >   1066                        skb = info->tx_fixup (dev, skb, GFP_ATOMIC);

It turns out that skb == NULL implies info->tx_fixup != NULL
and skb will be reassigned.
This is very dirty.

	Regards
		Oliver


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html