lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 22 Dec 2019 12:47:13 +0700 From: Phong Tran <tranmanphong@...il.com> To: syzbot+514595412b80dc817633@...kaller.appspotmail.com, davem@...emloft.net, gregkh@...uxfoundation.org, oneukum@...e.com Cc: allison@...utok.net, andreyknvl@...gle.com, kstewart@...uxfoundation.org, linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org, netdev@...r.kernel.org, swinslow@...il.com, syzkaller-bugs@...glegroups.com, tglx@...utronix.de, tranmanphong@...il.com, zhang.run@....com.cn Subject: [PATCH] ax88172a: fix wrong reading MAC malicious device Crash log KASAN: use-after-free Read in asix_suspend https://syzkaller.appspot.com/text?tag=CrashLog&x=1330a2c6e00000 (unnamed net_device) (uninitialized): Failed to read MAC address: 0 asix_read_cmd() with ret = 0 but this is a error. Fix the checking return value condition. Reported-by: syzbot+514595412b80dc817633@...kaller.appspotmail.com Tested by: https://groups.google.com/d/msg/syzkaller-bugs/0hHExZ030LI/yge-2Q_9BAAJ Signed-off-by: Phong Tran <tranmanphong@...il.com> --- drivers/net/usb/ax88172a.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c index af3994e0853b..525900896ce0 100644 --- a/drivers/net/usb/ax88172a.c +++ b/drivers/net/usb/ax88172a.c @@ -197,6 +197,8 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) /* Get the MAC address */ ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); if (ret < ETH_ALEN) { + if (ret >= 0) + ret = -ENXIO; netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); goto free; } -- 2.20.1
Powered by blists - more mailing lists