[PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

[PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

[Vivek Kumar Bhagat]

usbnet_start_xmit() - If info->tx_fixup is not defined by class driver,
NULL check does not happen for skb pointer and leads to NULL dereference.
__usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will
dereference NULL pointer.

Signed-off-by: Vivek Kumar Bhagat <vivek.bhagat@samsung.com>
---
 drivers/net/usb/usbnet.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3c86b10..ec4d224 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
 
 	if (skb)
 		skb_tx_timestamp(skb);
+	else
+		goto drop;
 
 	// some devices want funky USB-level framing, for
 	// win32 driver (usually) and/or hardware quirks
@@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
 		buf = kmalloc(size, GFP_KERNEL);
 		if (!buf)
 			goto out;
-	}
+	} else
+		goto out;
 
 	err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
 			      cmd, reqtype, value, index, buf, size,
-- 
1.7.9.5

Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

[Bjørn Mork]

Vivek Kumar Bhagat <vivek.bhagat@samsung.com> writes:

> usbnet_start_xmit() - If info->tx_fixup is not defined by class driver,
> NULL check does not happen for skb pointer and leads to NULL dereference.
> __usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will
> dereference NULL pointer.

That's two completely different issues.  Mixing them in a single patch
is only confusing things.


> Signed-off-by: Vivek Kumar Bhagat <vivek.bhagat@samsung.com>
> ---
>  drivers/net/usb/usbnet.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index 3c86b10..ec4d224 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
>  
>  	if (skb)
>  		skb_tx_timestamp(skb);
> +	else
> +		goto drop;
>  
>  	// some devices want funky USB-level framing, for
>  	// win32 driver (usually) and/or hardware quirks


This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
being called with a NULL skb.


> @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
>  		buf = kmalloc(size, GFP_KERNEL);
>  		if (!buf)
>  			goto out;
> -	}
> +	} else
> +		goto out;
>  
>  	err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
>  			      cmd, reqtype, value, index, buf, size,


This is also wrong.  It makes __usbnet_read_cmd() return -ENOMEM if
called with a NULL data pointer.  I don't know if it is used, but it's
perfectly valid to call __usbnet_read_cmd() with data == NULL if
size == 0. No memcpy will happen in this case because usb_control_msg
can only return 0 or an error

Please don't submit any more such patches without proper justification.
You cannot trust that someone will actually take the time to sanity
check your changes.  Patches claiming to fix a NULL dereference should
at least provide an oops.


Bjørn

Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

[Bjørn Mork]

Bjørn Mork <bjorn@mork.no> writes:
> Vivek Kumar Bhagat <vivek.bhagat@samsung.com> writes:
>
>> @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
>>  		buf = kmalloc(size, GFP_KERNEL);
>>  		if (!buf)
>>  			goto out;
>> -	}
>> +	} else
>> +		goto out;
>>  
>>  	err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
>>  			      cmd, reqtype, value, index, buf, size,
>
>
> This is also wrong.  It makes __usbnet_read_cmd() return -ENOMEM if
> called with a NULL data pointer.  I don't know if it is used, but it's
> perfectly valid to call __usbnet_read_cmd() with data == NULL if
> size == 0. No memcpy will happen in this case because usb_control_msg
> can only return 0 or an error

Just for the record - a simple grep for usbnet_read_cmd shows that at
least drivers/net/usb/plusb.c depends on the current behaviour:

static inline int
pl_vendor_req(struct usbnet *dev, u8 req, u8 val, u8 index)
{
        return usbnet_read_cmd(dev, req,
                                USB_DIR_IN | USB_TYPE_VENDOR |
                                USB_RECIP_DEVICE,
                                val, index, NULL, 0);
}



Bjørn

Re: Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

[Vivek Kumar Bhagat]

Dear Bjorn,

>>This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
>> being called with a NULL skb.
Also, if dev_hard_start_xmit() ensures that skb can not be NULL in usbnet_start_xmit()
then we should remove below check.
    if (skb)      <--- This check is confusing which says skb can be NULL.
                skb_tx_timestamp(skb); 


Best Regards,
Vivek

------- Original Message -------
Sender : Bjørn Mork<bjorn@mork.no>
Date : Aug 19, 2015 17:21 (GMT+05:30)
Title : Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

Vivek Kumar Bhagat writes:

> usbnet_start_xmit() - If info->tx_fixup is not defined by class driver,
> NULL check does not happen for skb pointer and leads to NULL dereference.
> __usbnet_read_cmd() - if data pointer is passed as NULL, memcpy will
> dereference NULL pointer.

That's two completely different issues.  Mixing them in a single patch
is only confusing things.


> Signed-off-by: Vivek Kumar Bhagat 
> ---
>  drivers/net/usb/usbnet.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
> index 3c86b10..ec4d224 100644
> --- a/drivers/net/usb/usbnet.c
> +++ b/drivers/net/usb/usbnet.c
> @@ -1294,6 +1294,8 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
>  
>   if (skb)
>   skb_tx_timestamp(skb);
> + else
> + goto drop;
>  
>   // some devices want funky USB-level framing, for
>   // win32 driver (usually) and/or hardware quirks


This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
being called with a NULL skb.


> @@ -1906,7 +1908,8 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
>   buf = kmalloc(size, GFP_KERNEL);
>   if (!buf)
>   goto out;
> - }
> + } else
> + goto out;
>  
>   err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
>         cmd, reqtype, value, index, buf, size,


This is also wrong.  It makes __usbnet_read_cmd() return -ENOMEM if
called with a NULL data pointer.  I don't know if it is used, but it's
perfectly valid to call __usbnet_read_cmd() with data == NULL if
size == 0. No memcpy will happen in this case because usb_control_msg
can only return 0 or an error

Please don't submit any more such patches without proper justification.
You cannot trust that someone will actually take the time to sanity
check your changes.  Patches claiming to fix a NULL dereference should
at least provide an oops.


Bjørn

Re: [PATCH] usbnet: dereference after null check in usbnet_start_xmit() and __usbnet_read_cmd()

[Bjørn Mork]

Vivek Kumar Bhagat <vivek.bhagat@samsung.com> writes:

> Dear Bjorn,
>
>>>This is wrong.  There are usbnet minidrivers depending on info->tx_fixup
>>> being called with a NULL skb.
> Also, if dev_hard_start_xmit() ensures that skb can not be NULL in usbnet_start_xmit()
> then we should remove below check.
>     if (skb)      <--- This check is confusing which says skb can be NULL.
>                 skb_tx_timestamp(skb); 


No, that test is there because of the ugly hack in cdc_ncm.  It doesn't
go through dev_hard_start_xmit(), but calls usbnet_start_xmit() directly
with a NULL skb as a signal to itself.  Yes, I told you it was ugly ;)

I do agree that it would be nice to make this go away.  But until that
happens usbnet_start_xmit() has to deal with NULL skbs, forwarding them
to the tx_fixup hook.


Bjørn