| Message ID | 907196681.281711439983295252.JavaMail.weblogic@ep2mlwas02b |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
Vivek Kumar Bhagat <vivek.bhagat@samsung.com> writes: > usbnet_start_xmit() - If info->tx_fixup is not defined by class driver, > NULL check does not happen for skb pointer and leads to NULL dereference. > __usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will > dereference NULL pointer. That's two completely different issues. Mixing them in a single patch is only confusing things. > Signed-off-by: Vivek Kumar Bhagat <vivek.bhagat@samsung.com> > --- > drivers/net/usb/usbnet.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c > index 3c86b10..ec4d224 100644 > --- a/drivers/net/usb/usbnet.c > +++ b/drivers/net/usb/usbnet.c > @@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, > > if (skb) > skb_tx_timestamp(skb); > + else > + goto drop; > > // some devices want funky USB-level framing, for > // win32 driver (usually) and/or hardware quirks This is wrong. There are usbnet minidrivers depending on info->tx_fixup being called with a NULL skb. > @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype, > buf = kmalloc(size, GFP_KERNEL); > if (!buf) > goto out; > - } > + } else > + goto out; > > err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), > cmd, reqtype, value, index, buf, size, This is also wrong. It makes __usbnet_read_cmd() return -ENOMEM if called with a NULL data pointer. I don't know if it is used, but it's perfectly valid to call __usbnet_read_cmd() with data == NULL if size == 0. No memcpy will happen in this case because usb_control_msg can only return 0 or an error Please don't submit any more such patches without proper justification. You cannot trust that someone will actually take the time to sanity check your changes. Patches claiming to fix a NULL dereference should at least provide an oops. Bjørn -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Bjørn Mork <bjorn@mork.no> writes: > Vivek Kumar Bhagat <vivek.bhagat@samsung.com> writes: > >> @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype, >> buf = kmalloc(size, GFP_KERNEL); >> if (!buf) >> goto out; >> - } >> + } else >> + goto out; >> >> err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), >> cmd, reqtype, value, index, buf, size, > > > This is also wrong. It makes __usbnet_read_cmd() return -ENOMEM if > called with a NULL data pointer. I don't know if it is used, but it's > perfectly valid to call __usbnet_read_cmd() with data == NULL if > size == 0. No memcpy will happen in this case because usb_control_msg > can only return 0 or an error Just for the record - a simple grep for usbnet_read_cmd shows that at least drivers/net/usb/plusb.c depends on the current behaviour: static inline int pl_vendor_req(struct usbnet *dev, u8 req, u8 val, u8 index) { return usbnet_read_cmd(dev, req, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, val, index, NULL, 0); } Bjørn -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 3c86b10..ec4d224 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb, if (skb) skb_tx_timestamp(skb); + else + goto drop; // some devices want funky USB-level framing, for // win32 driver (usually) and/or hardware quirks @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype, buf = kmalloc(size, GFP_KERNEL); if (!buf) goto out; - } + } else + goto out; err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), cmd, reqtype, value, index, buf, size,
usbnet_start_xmit() - If info->tx_fixup is not defined by class driver, NULL check does not happen for skb pointer and leads to NULL dereference. __usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will dereference NULL pointer. Signed-off-by: Vivek Kumar Bhagat <vivek.bhagat@samsung.com> --- drivers/net/usb/usbnet.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)