Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Phong Tran <tranmanphong@gmail.com>
To:     syzbot+514595412b80dc817633@syzkaller.appspotmail.com,
        davem@davemloft.net, gregkh@linuxfoundation.org, oneukum@suse.com
Cc:     allison@lohutok.net, andreyknvl@google.com,
        kstewart@linuxfoundation.org, linux-kernel@vger.kernel.org,
        linux-usb@vger.kernel.org, netdev@vger.kernel.org,
        swinslow@gmail.com, syzkaller-bugs@googlegroups.com,
        tglx@linutronix.de, tranmanphong@gmail.com, zhang.run@zte.com.cn
Subject: [PATCH] ax88172a: fix wrong reading MAC malicious device
Date:   Sun, 22 Dec 2019 12:47:13 +0700
Message-Id: <20191222054713.14887-1-tranmanphong@gmail.com>
In-Reply-To: <000000000000ab9d07059a410fae@google.com>
References: <000000000000ab9d07059a410fae@google.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Crash log KASAN: use-after-free Read in asix_suspend

https://syzkaller.appspot.com/text?tag=CrashLog&x=1330a2c6e00000
(unnamed net_device) (uninitialized): Failed to read MAC address: 0

asix_read_cmd() with ret = 0 but this is a error. Fix the checking
return value condition.

Reported-by: syzbot+514595412b80dc817633@syzkaller.appspotmail.com

Tested by:
https://groups.google.com/d/msg/syzkaller-bugs/0hHExZ030LI/yge-2Q_9BAAJ

Signed-off-by: Phong Tran <tranmanphong@gmail.com>
---
 drivers/net/usb/ax88172a.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
index af3994e0853b..525900896ce0 100644
--- a/drivers/net/usb/ax88172a.c
+++ b/drivers/net/usb/ax88172a.c
@@ -197,6 +197,8 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
 	/* Get the MAC address */
 	ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
 	if (ret < ETH_ALEN) {
+		if (ret >= 0)
+			ret = -ENXIO;
 		netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
 		goto free;
 	}
-- 
2.20.1