Re: [PATCH v3] ieee802154: atusb: fix uninit value in atusb_set_extended_addr

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello.

On 04.01.22 19:57, Alexander Aring wrote:
Hi,

On Tue, Jan 4, 2022 at 1:28 PM Pavel Skripkin <paskripkin@xxxxxxxxx> wrote:

Alexander reported a use of uninitialized value in
atusb_set_extended_addr(), that is caused by reading 0 bytes via
usb_control_msg().

Fix it by validating if the number of bytes transferred is actually
correct, since usb_control_msg() may read less bytes, than was requested
by caller.

Fail log:

BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]
BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]
BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056
Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd
  ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline]
  atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline]
  atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056
  usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396

Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver")
Reported-by: Alexander Potapenko <glider@xxxxxxxxxx>
Acked-by: Alexander Aring <aahringo@xxxxxxxxxx>
Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx>
---

Changes in v3:
         - Changed atusb_control_msg() to usb_control_msg() in
           atusb_get_and_show_build(), since request there may read various length
           data


Thanks for catching this.

Test passed my testing.


This patch has been applied to the wpan tree and will be
part of the next pull request to net. Thanks!

regards
Stefan Schmidt



[Index of Archives]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux