lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAB_54W7HQmm1ncCEsTmZFR+GVf6p6Vz0RMWDJXAhXQcW4r3hUQ@mail.gmail.com> Date: Mon, 3 Jan 2022 10:35:03 -0500 From: Alexander Aring <alex.aring@...il.com> To: Greg KH <greg@...ah.com> Cc: Pavel Skripkin <paskripkin@...il.com>, Stefan Schmidt <stefan@...enfreihafen.org>, "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, linux-wpan - ML <linux-wpan@...r.kernel.org>, "open list:NETWORKING [GENERAL]" <netdev@...r.kernel.org>, kernel list <linux-kernel@...r.kernel.org>, "# 3.19.x" <stable@...r.kernel.org>, Alexander Potapenko <glider@...gle.com> Subject: Re: [PATCH RFT] ieee802154: atusb: move to new USB API Hi, On Mon, 3 Jan 2022 at 08:03, Greg KH <greg@...ah.com> wrote: > > On Sun, Jan 02, 2022 at 08:19:43PM +0300, Pavel Skripkin wrote: > > Alexander reported a use of uninitialized value in > > atusb_set_extended_addr(), that is caused by reading 0 bytes via > > usb_control_msg(). > > > > Since there is an API, that cannot read less bytes, than was requested, > > let's move atusb driver to use it. It will fix all potintial bugs with > > uninit values and make code more modern > > > > Fail log: > > > > BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline] > > BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] > > BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 > > Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd > > ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline] > > atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] > > atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 > > usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 > > > > Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") > > Cc: stable@...r.kernel.org # 5.9 > > Reported-by: Alexander Potapenko <glider@...gle.com> > > Signed-off-by: Pavel Skripkin <paskripkin@...il.com> > > --- > > drivers/net/ieee802154/atusb.c | 61 +++++++++++++++++++++------------- > > 1 file changed, 38 insertions(+), 23 deletions(-) > > > > diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c > > index 23ee0b14cbfa..43befea0110f 100644 > > --- a/drivers/net/ieee802154/atusb.c > > +++ b/drivers/net/ieee802154/atusb.c > > @@ -80,10 +80,9 @@ struct atusb_chip_data { > > * in atusb->err and reject all subsequent requests until the error is cleared. > > */ > > > > -static int atusb_control_msg(struct atusb *atusb, unsigned int pipe, > > - __u8 request, __u8 requesttype, > > - __u16 value, __u16 index, > > - void *data, __u16 size, int timeout) > > +static int atusb_control_msg_recv(struct atusb *atusb, __u8 request, __u8 requesttype, > > + __u16 value, __u16 index, > > + void *data, __u16 size, int timeout) > > Why do you need a wrapper function at all? Why not just call the real > usb functions instead? > This driver has a lot of history, there is a comment which states: "To reduce the number of error checks in the code, we record the first error in atusb->err and reject all subsequent requests until the error is cleared." I think in the early state of this driver (as it was acting more as an USB<->SPI bridge) there was a lot of state handling involved. Nowadays we have a lot of such handling inside the device firmware (which is btw. open source). This might be not an excuse but an explanation why it was introduced in such a way. ... > > I would recommend just moving to use the real USB functions and no > wrapper function at all like this, it will make things more obvious and > easier to understand over time. okay. - Alex
Powered by blists - more mailing lists