netdev - [PATCH v1 0/5] Improve ASIX RX memory allocation error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 2 Oct 2015 14:39:39 +0100
From:	Dean Jenkins <Dean_Jenkins@...tor.com>
To:	<netdev@...r.kernel.org>
CC:	<linux-usb@...r.kernel.org>, <ben.hutchings@...ethink.co.uk>,
	<davem@...emloft.net>, <bjorn@...k.no>, <linux@...idrobins.net>,
	Mark Craske <Mark_Craske@...tor.com>
Subject: [PATCH v1 0/5] Improve ASIX RX memory allocation error handling

From: Mark Craske <Mark_Craske@...tor.com>

Please ignore the cover letter PATCH v2 as sent in error.
Patches are all v1, (there are no v2 patches yet)

The ASIX RX handler algorithm is weak on error handling.
There is a design flaw in the ASIX RX handler algorithm because the
implementation for handling RX Ethernet frames for the DUB-E100 C1 can
have Ethernet frames spanning multiple URBs. This means that payload data
from more than 1 URB is sometimes needed to fill the socket buffer with a
complete Ethernet frame. When the URB with the start of an Ethernet frame
is received then an attempt is made to allocate a socket buffer. If the
memory allocation fails then the algorithm sets the buffer pointer member
to NULL and the function exits (no crash yet). Subsequently, the RX hander
is called again to process the next URB which assumes there is a socket
buffer available and the kernel crashes when there is no buffer.

This patchset implements an improvement to the RX handling algorithm to
avoid a crash when no memory is available for the socket buffer.

The patchset will apply cleanly to the net-next master branch but the
created kernel has not been tested. The driver was tested on ARM kernels
v3.8 and v3.14 for a commercial product.

Dean Jenkins (5):
  asix: Rename remaining and size for clarity
  asix: Tidy-up 32-bit header word synchronisation
  asix: Simplify asix_rx_fixup_internal() netdev alloc
  asix: On RX avoid creating bad Ethernet frames
  asix: Continue processing URB if no RX netdev buffer

 drivers/net/usb/asix.h        |    2 +-
 drivers/net/usb/asix_common.c |  114 ++++++++++++++++++++++++++---------------
 2 files changed, 74 insertions(+), 42 deletions(-)

-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html