Dear Bjorn,
>>This is wrong. There are usbnet minidrivers depending on info->tx_fixup
>> being called with a NULL skb.
Also, if dev_hard_start_xmit() ensures that skb can not be NULL in
usbnet_start_xmit()
then we should remove below check.
if (skb) <--- This check is confusing which says skb can be NULL.
skb_tx_timestamp(skb);
Best Regards,
Vivek
------- Original Message -------
Sender : Bjørn Mork<bj...@mork.no>
Date : Aug 19, 2015 17:21 (GMT+05:30)
Title : Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit()
and __usbnet_read_cmd()
Vivek Kumar Bhagat writes:
> usbnet_start_xmit() - If info->tx_fixup is not defined by class driver,
> NULL check does not happen for skb pointer and leads to NULL dereference.
> __usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will
> dereference NULL pointer.
That's two completely different issues. Mixing them in a single patch
is only confusing things.
> Signed-off-by: Vivek Kumar Bhagat
> ---
> drivers/net/usb/usbnet.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index 3c86b10..ec4d224 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
>
> if (skb)
> skb_tx_timestamp(skb);
> + else
> + goto drop;
>
> // some devices want funky USB-level framing, for
> // win32 driver (usually) and/or hardware quirks
This is wrong. There are usbnet minidrivers depending on info->tx_fixup
being called with a NULL skb.
> @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8
> cmd, u8 reqtype,
> buf = kmalloc(size, GFP_KERNEL);
> if (!buf)
> goto out;
> - }
> + } else
> + goto out;
>
> err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
> cmd, reqtype, value, index, buf, size,
This is also wrong. It makes __usbnet_read_cmd() return -ENOMEM if
called with a NULL data pointer. I don't know if it is used, but it's
perfectly valid to call __usbnet_read_cmd() with data == NULL if
size == 0. No memcpy will happen in this case because usb_control_msg
can only return 0 or an error
Please don't submit any more such patches without proper justification.
You cannot trust that someone will actually take the time to sanity
check your changes. Patches claiming to fix a NULL dereference should
at least provide an oops.
Bjørn
