summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--pcap_mm.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/pcap_mm.c b/pcap_mm.c
index 952f872..486fbfe 100644
--- a/pcap_mm.c
+++ b/pcap_mm.c
@@ -64,8 +64,8 @@ static ssize_t pcap_mm_write(int fd, pcap_pkthdr_t *phdr, enum pcap_type type,
return hdrsize + len;
}
-static ssize_t pcap_mm_read(int fd, pcap_pkthdr_t *phdr, enum pcap_type type,
- uint8_t *packet, size_t len)
+static ssize_t pcap_mm_read(int fd __maybe_unused, pcap_pkthdr_t *phdr,
+ enum pcap_type type, uint8_t *packet, size_t len)
{
size_t hdrsize = pcap_get_hdr_length(phdr, type), hdrlen;
@@ -169,7 +169,7 @@ static int pcap_mm_prepare_access(int fd, enum pcap_mode mode, bool jumbo)
return 0;
}
-static void pcap_mm_fsync(int fd)
+static void pcap_mm_fsync(int fd __maybe_unused)
{
msync(ptr_va_start, (off_t) (ptr_va_curr - ptr_va_start), MS_ASYNC);
}
/kasan/report.c:286 [< inline >] kasan_report mm/kasan/report.c:306 [<ffffffff817e562a>] __asan_report_load_n_noabort+0x3a/0x40 mm/kasan/report.c:337 [< inline >] config_buf drivers/usb/gadget/legacy/inode.c:1298 [<ffffffff8322c8fa>] gadgetfs_setup+0x208a/0x20e0 drivers/usb/gadget/legacy/inode.c:1368 [<ffffffff830fdcd0>] dummy_timer+0x11f0/0x36d0 drivers/usb/gadget/udc/dummy_hcd.c:1858 [<ffffffff814807c1>] call_timer_fn+0x241/0x800 kernel/time/timer.c:1308 [< inline >] expire_timers kernel/time/timer.c:1348 [<ffffffff81482de6>] __run_timers+0xa06/0xec0 kernel/time/timer.c:1641 [<ffffffff814832c1>] run_timer_softirq+0x21/0x80 kernel/time/timer.c:1654 [<ffffffff84f4af8b>] __do_softirq+0x2fb/0xb63 kernel/softirq.c:284 The cause of the bug is subtle. The dev_config() routine gets called twice by the fuzzer. The first time, the user data contains both a full-speed configuration descriptor and a high-speed config descriptor, causing dev->hs_config to be set. But it also contains an invalid device descriptor, so the buffer containing the descriptors is deallocated and dev_config() returns an error. The second time dev_config() is called, the user data contains only a full-speed config descriptor. But dev->hs_config still has the stale pointer remaining from the first call, causing the routine to think that there is a valid high-speed config. Later on, when the driver dereferences the stale pointer to copy that descriptor, we get a use-after-free access. The fix is simple: Clear dev->hs_config if the passed-in data does not contain a high-speed config descriptor. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> CC: <stable@vger.kernel.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat
-rw-r--r--drivers/usb/gadget/legacy/inode.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c