netdev - Re^2:: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <140453008.311141440043155179.JavaMail.weblogic@ep2mlwas02d>
Date:	Thu, 20 Aug 2015 03:59:15 +0000 (GMT)
From:	Vivek Kumar Bhagat <vivek.bhagat@...sung.com>
To:	Bjørn Mork <bjorn@...k.no>
Cc:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Nitin Jhanwar <nitin.j@...sung.com>,
	HEMANSHU SRIVASTAVA <hemanshu.s@...sung.com>
Subject: Re^2:: [PATCH] usbnet: dereference after null check in
 usbnet_start_xmit() and __usbnet_read_cmd()

Dear Bjorn,

>> This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
>> being called with a NULL skb.
I am using ax88179_178a driver and not familiar with usbnet minidrivers.
When ax88179_tx_fixup() is called with NULL skb from
usbnet_start_xmit(), I get a kernel crash.
    Backtrace:
    09:14:569>[0-553.5598] [<befaa194>] (ax88179_tx_fixup+0x0/0x16c [ax88179_178a]) from [<befef7a8>] (usbnet_start_xmit+0xa
    09:14:569>0/0x420 [usbnet])
    09:14:570>[0-553.5711]  r6:cb5ec280 r5:00000000 r4:cb5ebd40
    09:14:572>[0-553.5755] [<befef708>] (usbnet_start_xmit+0x0/0x420 [usbnet]) from [<c0400040>] (dev_hard_start_xmit+0x2ec/
    09:14:572>0x558)
    09:14:572>[0-553.5858] [<c03ffd54>] (dev_hard_start_xmit+0x0/0x558)
In case skb NULL check can not be added in usbnet_start_xmit()
then NULL check is required in ax88179_tx_fixup() or asix_tx_fixup().

>> This is also wrong.  It makes __usbnet_read_cmd() return -ENOMEM if
>> called with a NULL data pointer.
>>No memcpy will happen in this case because usb_control_msg
>>can only return 0 or an error
Yes, some of the USB control message is sent from host to gadget without
expecting any data in return. This is my mistake. I apologise for this.


Best Regards,
Vivek

------- Original Message -------
Sender : Bjørn Mork<bjorn@...k.no>
Date : Aug 19, 2015 17:21 (GMT+05:30)
Title : Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

Vivek Kumar Bhagat writes:

> usbnet_start_xmit() - If info->tx_fixup is not defined by class driver,
> NULL check does not happen for skb pointer and leads to NULL dereference.
> __usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will
> dereference NULL pointer.

That's two completely different issues.  Mixing them in a single patch
is only confusing things.


> Signed-off-by: Vivek Kumar Bhagat 
> ---
>  drivers/net/usb/usbnet.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index 3c86b10..ec4d224 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
>  
>   if (skb)
>   skb_tx_timestamp(skb);
> + else
> + goto drop;
>  
>   // some devices want funky USB-level framing, for
>   // win32 driver (usually) and/or hardware quirks


This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
being called with a NULL skb.


> @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
>   buf = kmalloc(size, GFP_KERNEL);
>   if (!buf)
>   goto out;
> - }
> + } else
> + goto out;
>  
>   err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
>         cmd, reqtype, value, index, buf, size,


This is also wrong.  It makes __usbnet_read_cmd() return -ENOMEM if
called with a NULL data pointer.  I don't know if it is used, but it's
perfectly valid to call __usbnet_read_cmd() with data == NULL if
size == 0. No memcpy will happen in this case because usb_control_msg
can only return 0 or an error

Please don't submit any more such patches without proper justification.
You cannot trust that someone will actually take the time to sanity
check your changes.  Patches claiming to fix a NULL dereference should
at least provide an oops.


Bjørn