| Message ID | 1594821571-17833-1-git-send-email-george.kennedy@oracle.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [v2,1/1] ax88172a: fix ax88172a_unbind() failures | expand |
On Wed, 15 Jul 2020 09:59:31 -0400 George Kennedy wrote: > If ax88172a_unbind() fails, make sure that the return code is > less than zero so that cleanup is done properly and avoid UAF. > > Signed-off-by: George Kennedy <george.kennedy@oracle.com> > Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers") Applied, thanks!
diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c index 4e514f5..fd3a04d 100644 --- a/drivers/net/usb/ax88172a.c +++ b/drivers/net/usb/ax88172a.c @@ -187,6 +187,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); if (ret < ETH_ALEN) { netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); + ret = -EIO; goto free; } memcpy(dev->net->dev_addr, buf, ETH_ALEN);
If ax88172a_unbind() fails, make sure that the return code is less than zero so that cleanup is done properly and avoid UAF. Signed-off-by: George Kennedy <george.kennedy@oracle.com> Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com --- drivers/net/usb/ax88172a.c | 1 + 1 file changed, 1 insertion(+)