lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <907196681.281711439983295252.JavaMail.weblogic@ep2mlwas02b>
Date:	Wed, 19 Aug 2015 11:21:35 +0000 (GMT)
From:	Vivek Kumar Bhagat <vivek.bhagat@...sung.com>
To:	netdev@...r.kernel.org
Cc:	nitin.j@...sung.com, hemanshu.s@...sung.com
Subject: [PATCH] usbnet: dereference after null check in usbnet_start_xmit()
 and __usbnet_read_cmd()

usbnet_start_xmit() - If info->tx_fixup is not defined by class driver,
NULL check does not happen for skb pointer and leads to NULL dereference.
__usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will
dereference NULL pointer.

Signed-off-by: Vivek Kumar Bhagat <vivek.bhagat@...sung.com>
---
 drivers/net/usb/usbnet.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3c86b10..ec4d224 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
 
 	if (skb)
 		skb_tx_timestamp(skb);
+	else
+		goto drop;
 
 	// some devices want funky USB-level framing, for
 	// win32 driver (usually) and/or hardware quirks
@@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
 		buf = kmalloc(size, GFP_KERNEL);
 		if (!buf)
 			goto out;
-	}
+	} else
+		goto out;
 
 	err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
 			      cmd, reqtype, value, index, buf, size,
-- 
1.7.9.5

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ