netdev - Re: Error in the hso driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1548618592071.43193@ece.ufl.edu>
Date:   Sun, 27 Jan 2019 19:49:52 +0000
From:   "Yavuz, Tuba" <tuba@....ufl.edu>
To:     Greg KH <greg@...ah.com>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>
Subject: Re: Error in the hso driver

Here is a proposed patch:

--- drivers/net/usb/hso.c.orig	2019-01-27 14:45:58.232683119 -0500
+++ drivers/net/usb/hso.c	2019-01-27 14:47:43.592683629 -0500
@@ -2377,7 +2377,7 @@ static void hso_free_net_device(struct h
 
 	remove_net_device(hso_net->parent);
 
-	if (hso_net->net)
+	if (hso_net->net && hso_net->net->reg_state == NETREG_REGISTERED)
 		unregister_netdev(hso_net->net);
 
 	/* start freeing */



Tuba Yavuz, Ph.D.
Assistant Professor
Electrical and Computer Engineering Department
University of Florida
Gainesville, FL 32611
Webpage: http://www.tuba.ece.ufl.edu/
Email: tuba@....ufl.edu
Phone: (352) 846 0202

________________________________________
From: Greg KH <greg@...ah.com>
Sent: Sunday, January 27, 2019 2:35 PM
To: Yavuz, Tuba
Cc: netdev@...r.kernel.org; davem@...emloft.net
Subject: Re: Error in the hso driver

On Sun, Jan 27, 2019 at 06:38:41PM +0000, Yavuz, Tuba wrote:
> Hello,
>
>
> On an error path inside the hso_create_net_device function of the hso driver (drivers/net/usb/hso), hso_free_net_device gets called. This causes a negative reference count in the net device if register_netdev has not been called yet as hso_free_net_device calls unregister_netdev regardless. I think the driver should distinguish these cases and call unregister_netdev only if register_netdev has been called.
>
>
> Detected on v4.14-rc2 but I believe the problem still exists in the newer versions.

Can you send a patch to solve this issue?  That's the best way to handle
it as you get the proper credit and we can understand exactly what you
are trying to show here.

thanks,

greg k-h