From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alexander Potapenko <glider@google.com>,
Alexander Aring <aahringo@redhat.com>,
Pavel Skripkin <paskripkin@gmail.com>,
Stefan Schmidt <stefan@datenfreihafen.org>
Subject: [PATCH 4.14 05/22] ieee802154: atusb: fix uninit value in atusb_set_extended_addr
Date: Mon, 10 Jan 2022 08:22:58 +0100 [thread overview]
Message-ID: <20220110071814.444218979@linuxfoundation.org> (raw)
In-Reply-To: <20220110071814.261471354@linuxfoundation.org>
From: Pavel Skripkin <paskripkin@gmail.com>
commit 754e4382354f7908923a1949d8dc8d05f82f09cb upstream.
Alexander reported a use of uninitialized value in
atusb_set_extended_addr(), that is caused by reading 0 bytes via
usb_control_msg().
Fix it by validating if the number of bytes transferred is actually
correct, since usb_control_msg() may read less bytes, than was requested
by caller.
Fail log:
BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]
BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]
BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056
Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd
ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]
atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]
atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056
usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
Reported-by: Alexander Potapenko <glider@google.com>
Acked-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20220104182806.7188-1-paskripkin@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/atusb.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -84,7 +84,9 @@ static int atusb_control_msg(struct atus
ret = usb_control_msg(usb_dev, pipe, request, requesttype,
value, index, data, size, timeout);
- if (ret < 0) {
+ if (ret < size) {
+ ret = ret < 0 ? ret : -ENODATA;
+
atusb->err = ret;
dev_err(&usb_dev->dev,
"atusb_control_msg: req 0x%02x val 0x%x idx 0x%x, error %d\n",
@@ -656,9 +658,9 @@ static int atusb_get_and_show_build(stru
if (!build)
return -ENOMEM;
- ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
- ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0,
- build, ATUSB_BUILD_SIZE, 1000);
+ /* We cannot call atusb_control_msg() here, since this request may read various length data */
+ ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD,
+ ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000);
if (ret >= 0) {
build[ret] = 0;
dev_info(&usb_dev->dev, "Firmware: build %s\n", build);
next prev parent reply other threads:[~2022-01-10 7:29 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-10 7:22 [PATCH 4.14 00/22] 4.14.262-rc1 review Greg Kroah-Hartman
2022-01-10 7:22 ` [PATCH 4.14 01/22] Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models Greg Kroah-Hartman
2022-01-10 7:22 ` [PATCH 4.14 02/22] tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() Greg Kroah-Hartman
2022-01-10 7:22 ` [PATCH 4.14 03/22] tracing: Tag trace_percpu_buffer as a percpu pointer Greg Kroah-Hartman
2022-01-10 7:22 ` [PATCH 4.14 04/22] virtio_pci: Support surprise removal of virtio pci device Greg Kroah-Hartman
2022-01-10 7:22 ` Greg Kroah-Hartman [this message]
2022-01-10 7:22 ` [PATCH 4.14 06/22] RDMA/core: Dont infoleak GRH fields Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 07/22] mac80211: initialize variable have_higher_than_11mbit Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 08/22] i40e: fix use-after-free in i40e_sync_filters_subtask() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 09/22] i40e: Fix incorrect netdevs real number of RX/TX queues Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 10/22] ipv6: Check attribute length for RTA_GATEWAY in multipath route Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 11/22] ipv6: Check attribute length for RTA_GATEWAY when deleting " Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 12/22] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 13/22] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 14/22] power: reset: ltc2952: Fix use of floating point literals Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 15/22] rndis_host: support Hytera digital radios Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 16/22] phonet: refcount leak in pep_sock_accep Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 17/22] ipv6: Continue processing multipath route even if gateway attribute is invalid Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 18/22] ipv6: Do cleanup if attribute validation fails in multipath route Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 19/22] scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 20/22] ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 21/22] net: udp: fix alignment problem in udp4_seq_show() Greg Kroah-Hartman
2022-01-10 7:23 ` [PATCH 4.14 22/22] mISDN: change function names to avoid conflicts Greg Kroah-Hartman
2022-01-10 11:49 ` [PATCH 4.14 00/22] 4.14.262-rc1 review Jon Hunter
2022-01-10 23:49 ` Guenter Roeck
2022-01-11 6:24 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220110071814.444218979@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aahringo@redhat.com \
--cc=glider@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=paskripkin@gmail.com \
--cc=stable@vger.kernel.org \
--cc=stefan@datenfreihafen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.