lan78xx_read_reg() and lan78xx_read_stats() accept a control transfer
that returns fewer bytes than requested and then use the uninitialized
rest of their kmalloc()ed buffers. A device that sends short replies can
get stale heap contents used as the MAC address of the interface, and makes
ethtool -S report them to unprivileged users, including kernel text and
direct map pointers.
Patch 2 makes the register and statistics helpers fail on short transfers. Patch 1 comes first so
that a failing statistics read does not report uninitialized stack data
instead.
The bugs need a malicious or emulated USB device, which
Documentation/process/threat-model.rst treats as a regular bug rather
than a vulnerability, so they are posted publicly.
Testing: the series builds without warnings (W=1) on net-next and passes
checkpatch --strict. It applies unchanged to v6.12.105, where it was
tested with a LAN7800 emulated by raw-gadget + dummy_hcd, booted with
init_on_alloc=0:
- Zero-length statistics replies. Before: 40 to 88 of the 235 ethtool -S
counters are non-zero, including usb_api_blocking_completion() and
direct map pointers. After: every read fails with -EIO and all
counters stay zero.
- 100 byte statistics replies. Before: 110 of the 235 counters are
non-zero. With patch 1 only: 29 are, so the stale tail of the buffer
still gets through. With both patches: the read fails with -EIO and
all counters stay zero.
- Zero-length RX_ADDRL/RX_ADDRH replies. Before: the MAC address
differs on every probe, is programmed into the MAC filter and is
used as the address of the interface. After: the
probe fails with -EIO.
Both bugs were found, and the patches written, with LLM assistance.
v1 to v4 carried Assisted-by tags; v5 drops them following commit
1e035297ffda ("docs: remove Assisted-by references").
Changes in v5:
- retarget to net-next and drop the Fixes: and Cc: stable tags, since
the bugs need a misbehaving device (Andrew Lunn)
- add Andrew's Reviewed-by
- drop the Assisted-by tags (see above) and rebase on current net-next
v4: https://lore.kernel.org/all/20261020001621.2920-1-law.wei.jie@gt.tech.gov.sg/ (local)
Changes in v4:
- 2/2: drop the examples from the commit message and move the note that
it depends on 1/2 below the --- line (Andrew Lunn)
- 2/2: also fail on a short transfer in lan78xx_write_reg(), for
symmetry with the read helpers (Andrew Lunn)
v3: https://lore.kernel.org/all/20261018062419.21921-1-law.wei.jie@gt.tech.gov.sg/ (local)
- add the missing Signed-off-by; no other changes
v2: https://lore.kernel.org/all/20261018061734.19488-1-law.wei.jie@gt.tech.gov.sg/ (local)
- 2/2: the commit message now says that with patch 1 only a partial
statistics reply (1 to 187 bytes) still leaks, and that patch 2 depends on
patch 1; the MAC address paragraph no longer claims a write-back to
RX_ADDRL/RX_ADDRH, which happens only for an invalid address. The cover
letter gains a partial-reply test. No code change.
v1: https://lore.kernel.org/all/20261014025602.26334-1-law.wei.jie@gt.tech.gov.sg/ (local)
Wei Jie Law (2):
net: usb: lan78xx: do not update statistics after a failed read
net: usb: lan78xx: reject short register and statistics transfers
drivers/net/usb/lan78xx.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
base-commit: 099e433a8bf4914a727b46e0c8a1a3d96c94b6a2
--
2.43.0