From: Oliver Neukum <oneukum@suse.com>
To: Andrey Konovalov <andreyknvl@google.com>
Cc: allan <allan@asix.com.tw>,
Colin Ian King <colin.king@canonical.com>,
"David S . Miller" <davem@davemloft.net>,
Philippe Reynes <tremyfr@gmail.com>,
Dmitry Vyukov <dvyukov@google.com>,
Kostya Serebryany <kcc@google.com>,
Greg Ungerer <gerg@linux-m68k.org>,
Dean Jenkins <Dean_Jenkins@mentor.com>,
Peter Chen <peter.chen@nxp.com>,
LKML <linux-kernel@vger.kernel.org>,
USB list <linux-usb@vger.kernel.org>,
netdev <netdev@vger.kernel.org>
Subject: Re: [PATCH] net: usb: asix: fill null-ptr-deref in asix_suspend
Date: Mon, 06 Nov 2017 16:20:58 +0100 [thread overview]
Message-ID: <1509981658.2024.37.camel@suse.com> (raw)
In-Reply-To: <CAAeHK+z9xWusLR6n_ooBdLeCQwzmLeMrbT+7cFm1PL1vuG4JMQ@mail.gmail.com>
Am Montag, den 06.11.2017, 13:30 +0100 schrieb Andrey Konovalov:
> On Mon, Nov 6, 2017 at 10:49 AM, Oliver Neukum <oneukum@suse.com> wrote:
> >
> >
> > 2. Will a device work after that? The appropriate fix may be to wait
> > until the device is properly initialized.
>
> This shouldn't affect real devices as far as I understand. The crash
> can be caused by a crafted malicious device.
Hi!
Hm. That seems strange as driver_priv is kmalloced. Do you
still have a descriptor that causes this?
Shouldn't we rather reject such a broken device?
Regards
Oliver
next prev parent reply other threads:[~2017-11-06 15:20 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-02 20:26 [PATCH] net: usb: asix: fill null-ptr-deref in asix_suspend Andrey Konovalov
2017-11-04 13:42 ` David Miller
2017-11-06 9:49 ` Oliver Neukum
2017-11-06 12:30 ` Andrey Konovalov
2017-11-06 15:20 ` Oliver Neukum [this message]
2017-11-06 16:05 ` Andrey Konovalov
2017-11-06 16:32 ` Oliver Neukum
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1509981658.2024.37.camel@suse.com \
--to=oneukum@suse.com \
--cc=Dean_Jenkins@mentor.com \
--cc=allan@asix.com.tw \
--cc=andreyknvl@google.com \
--cc=colin.king@canonical.com \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=gerg@linux-m68k.org \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=peter.chen@nxp.com \
--cc=tremyfr@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).