From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753919AbdKFPZF (ORCPT <rfc822;w@1wt.eu>);
        Mon, 6 Nov 2017 10:25:05 -0500
Received: from mx2.suse.de ([195.135.220.15]:60352 "EHLO mx2.suse.de"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1753869AbdKFPZC (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 6 Nov 2017 10:25:02 -0500
Message-ID: <1509981658.2024.37.camel@suse.com>
Subject: Re: [PATCH] net: usb: asix: fill null-ptr-deref in asix_suspend
From: Oliver Neukum <oneukum@suse.com>
To: Andrey Konovalov <andreyknvl@google.com>
Cc: allan <allan@asix.com.tw>, Colin Ian King <colin.king@canonical.com>,
        "David S . Miller" <davem@davemloft.net>,
        Philippe Reynes <tremyfr@gmail.com>,
        Dmitry Vyukov <dvyukov@google.com>, Kostya Serebryany <kcc@google.com>,
        Greg Ungerer <gerg@linux-m68k.org>,
        Dean Jenkins <Dean_Jenkins@mentor.com>,
        Peter Chen <peter.chen@nxp.com>, LKML <linux-kernel@vger.kernel.org>,
        USB list <linux-usb@vger.kernel.org>, netdev <netdev@vger.kernel.org>
Date: Mon, 06 Nov 2017 16:20:58 +0100
In-Reply-To: <CAAeHK+z9xWusLR6n_ooBdLeCQwzmLeMrbT+7cFm1PL1vuG4JMQ@mail.gmail.com>
References: <9e768a837391af216cf1d2c8ac08af41f28cb147.1509654127.git.andreyknvl@google.com>
         <1509961757.2024.21.camel@suse.com>
         <CAAeHK+z9xWusLR6n_ooBdLeCQwzmLeMrbT+7cFm1PL1vuG4JMQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.20.5 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Am Montag, den 06.11.2017, 13:30 +0100 schrieb Andrey Konovalov:
> On Mon, Nov 6, 2017 at 10:49 AM, Oliver Neukum <oneukum@suse.com> wrote:
> > 
> > 
> > 2. Will a device work after that? The appropriate fix may be to wait
> > until the device is properly initialized.
> 
> This shouldn't affect real devices as far as I understand. The crash
> can be caused by a crafted malicious device.

Hi!

Hm. That seems strange as driver_priv is kmalloced. Do you
still have a descriptor that causes this?
Shouldn't we rather reject such a broken device?

	Regards
		Oliver