lkml.org 
[lkml]   [2020]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 28/86] ax88172a: fix ax88172a_unbind() failures
    Date
    From: George Kennedy <george.kennedy@oracle.com>

    [ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ]

    If ax88172a_unbind() fails, make sure that the return code is
    less than zero so that cleanup is done properly and avoid UAF.

    Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers")
    Signed-off-by: George Kennedy <george.kennedy@oracle.com>
    Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/usb/ax88172a.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
    index 914cac55a7ae7..909755ef71ac3 100644
    --- a/drivers/net/usb/ax88172a.c
    +++ b/drivers/net/usb/ax88172a.c
    @@ -210,6 +210,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
    ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
    if (ret < ETH_ALEN) {
    netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
    + ret = -EIO;
    goto free;
    }
    memcpy(dev->net->dev_addr, buf, ETH_ALEN);
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-07-27 16:40    [W:4.079 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site