lkml.org 
[lkml]   [2022]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 03/59] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
    Date
    From: Zekun Shen <bruceshenzk@gmail.com>

    [ Upstream commit ae80b6033834342601e99f74f6a62ff5092b1cee ]

    Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref
    when ar->tx_cmd->odata is NULL. The patch adds a null check to
    prevent such case.

    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    ar5523_cmd+0x46a/0x581 [ar5523]
    ar5523_probe.cold+0x1b7/0x18da [ar5523]
    ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523]
    ? __pm_runtime_set_status+0x54a/0x8f0
    ? _raw_spin_trylock_bh+0x120/0x120
    ? pm_runtime_barrier+0x220/0x220
    ? __pm_runtime_resume+0xb1/0xf0
    usb_probe_interface+0x25b/0x710
    really_probe+0x209/0x5d0
    driver_probe_device+0xc6/0x1b0
    device_driver_attach+0xe2/0x120

    I found the bug using a custome USBFuzz port. It's a research work
    to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only,
    providing hand-crafted usb descriptors to QEMU.

    After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START,
    I got the null-ptr-deref bug. I believe the bug is triggerable whenever
    cmd->odata is NULL. After patching, I tested with the same input and no
    longer see the KASAN report.

    This was NOT tested on a real device.

    Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/YXsmPQ3awHFLuAj2@10-18-43-117.dynapool.wireless.nyu.edu
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ar5523/ar5523.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
    index 4c57e79e5779a..58e189ec672f9 100644
    --- a/drivers/net/wireless/ath/ar5523/ar5523.c
    +++ b/drivers/net/wireless/ath/ar5523/ar5523.c
    @@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb)
    ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START");
    return;
    }
    + if (!cmd->odata) {
    + ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply");
    + return;
    + }
    memcpy(cmd->odata, hdr + 1, sizeof(u32));
    cmd->olen = sizeof(u32);
    cmd->res = 0;
    --
    2.34.1
    \
     
     \ /
      Last update: 2022-01-18 04:40    [W:4.418 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site