| Message ID | 1594409928-15763-1-git-send-email-george.kennedy@oracle.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/1] ax88172a: fix ax88172a_unbind() failures | expand |
From: George Kennedy <george.kennedy@oracle.com> Date: Fri, 10 Jul 2020 15:38:48 -0400 > If ax88172a_unbind() fails, make sure that the return code is > less than zero so that cleanup is done properly and avoid UAF. > > Signed-off-by: George Kennedy <george.kennedy@oracle.com> > Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com Networking patches should be sent to netdev@vger.kernel.org Do not attempt to fix this by adding that list to the CC: of this discussion. Make a fresh new patch posting instead. Thank you.
diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c index 4e514f5..fd9faf2 100644 --- a/drivers/net/usb/ax88172a.c +++ b/drivers/net/usb/ax88172a.c @@ -237,6 +237,8 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) free: kfree(priv); + if (ret >= 0) + ret = -EIO; return ret; }
If ax88172a_unbind() fails, make sure that the return code is less than zero so that cleanup is done properly and avoid UAF. Signed-off-by: George Kennedy <george.kennedy@oracle.com> Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com --- drivers/net/usb/ax88172a.c | 2 ++ 1 file changed, 2 insertions(+)