From: Sasha Levin <sashal@kernel.org>
To: Kristian Evensen <kristian.evensen@gmail.com>
Cc: stable <stable@vger.kernel.org>, "Bjørn Mork" <bjorn@mork.no>
Subject: Re: [PATCH] qmi_wwan: Fix out-of-bounds read
Date: Fri, 28 Jun 2019 10:14:33 -0400 [thread overview]
Message-ID: <20190628141433.GF11506@sasha-vm> (raw)
In-Reply-To: <CAKfDRXhHWCxKK6gDciar5eQg9Ojv4+0C7tgaSOmQFFGLCL9gqw@mail.gmail.com>
On Fri, Jun 28, 2019 at 06:14:33AM +0200, Kristian Evensen wrote:
>Hi,
>
>On Thu, Jun 27, 2019 at 12:01 PM Kristian Evensen
><kristian.evensen@gmail.com> wrote:
>>
>> commit 904d88d743b0c94092c5117955eab695df8109e8 upstream.
>>
>> The syzbot reported
>>
>> Call Trace:
>> __dump_stack lib/dump_stack.c:77 [inline]
>> dump_stack+0xca/0x13e lib/dump_stack.c:113
>> print_address_description+0x67/0x231 mm/kasan/report.c:188
>> __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:317
>> kasan_report+0xe/0x20 mm/kasan/common.c:614
>> qmi_wwan_probe+0x342/0x360 drivers/net/usb/qmi_wwan.c:1417
>> usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
>> really_probe+0x281/0x660 drivers/base/dd.c:509
>> driver_probe_device+0x104/0x210 drivers/base/dd.c:670
>> __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
>> bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
>>
>> Caused by too many confusing indirections and casts.
>> id->driver_info is a pointer stored in a long. We want the
>> pointer here, not the address of it.
>>
>> Thanks-to: Hillf Danton <hdanton@sina.com>
>> Reported-by: syzbot+b68605d7fadd21510de1@syzkaller.appspotmail.com
>> Cc: Kristian Evensen <kristian.evensen@gmail.com>
>> Fixes: e4bf63482c30 ("qmi_wwan: Add quirk for Quectel dynamic config")
>> Signed-off-by: Bjørn Mork <bjorn@mork.no>
>>
>> [Upstream commit did not apply because I shuffled two lines in the
>> backport. The fixes tag for 4.14 is 3a6a5107ceb3.]
>>
>> Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
>> ---
>
>I see now that I forgot to set the correct prefix for the patch. The
>prefix should be PATCH 4.14. Sorry about that. Please let me know if I
>should resubmit.
I've also queued the upstream fix to 5.1 and 4.19.
--
Thanks,
Sasha
prev parent reply other threads:[~2019-06-28 14:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-27 10:01 [PATCH] qmi_wwan: Fix out-of-bounds read Kristian Evensen
2019-06-28 4:14 ` Kristian Evensen
2019-06-28 14:11 ` Sasha Levin
2019-06-28 14:14 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190628141433.GF11506@sasha-vm \
--to=sashal@kernel.org \
--cc=bjorn@mork.no \
--cc=kristian.evensen@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox