kgess-mirror/freebsd-src
1
0
Fork 0
mirror of https://git.freebsd.org/src.git synced 2026-01-11 19:57:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix NULL deref segfault in bhyve's usb_mouse.c

Browse source 
Some of the cases inside umouse_request() (usr.sbin/bhyve/usb_mouse.c)
use the data component of an event, while only partially checking if
it's NULL. 'data' has a NULL check, but then 'data' is immediately
deferenced anyway after the check regardless of if it's NULL or not.

For example:
	case UREQ(UR_GET_STATUS, UT_READ_INTERFACE):
	case UREQ(UR_GET_STATUS, UT_READ_ENDPOINT):
		DPRINTF(("umouse: (UR_GET_STATUS, UT_READ_INTERFACE)"));
		if (data != NULL && len > 1) {
			USETW(udata, 0);
			data->blen = len - 2;
			data->bdone += 2;
		}
		eshort = data->blen > 0;
		break;

There are actually four occurrences of this same bug, each in a
different case in this switch block.

Signed-off-by: Jack Bendtsen <jackdbendtsen@gmail.com>
PR: 282237
Reviewed by: imp, jhb, vexeduxr
MFC After: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/1728
This commit is contained in:
Jack Bendtsen 2025-06-19 17:40:31 +10:00 • committed by Warner Losh
parent 3e72ce4081
commit 7631790422
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
usr.sbin/bhyve/usb_mouse.c
View file

@ -538,7 +538,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer)
data->bdone += 2;
}
eshort = data->blen > 0;
eshort = data != NULL && data->blen > 0;
break;
case UREQ(UR_GET_STATUS, UT_READ_INTERFACE):
@ -549,7 +549,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer)
data->blen = len - 2;
data->bdone += 2;
}
eshort = data->blen > 0;
eshort = data != NULL && data->blen > 0;
break;
case UREQ(UR_SET_ADDRESS, UT_WRITE_DEVICE):
@ -634,7 +634,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer)
data->blen = len - 1;
data->bdone += 1;
}
eshort = data->blen > 0;
eshort = data != NULL && data->blen > 0;
break;
case UREQ(UMOUSE_GET_PROTOCOL, UT_READ_CLASS_INTERFACE):
@ -643,7 +643,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer)
data->blen = len - 1;
data->bdone += 1;
}
eshort = data->blen > 0;
eshort = data != NULL && data->blen > 0;
break;
case UREQ(UMOUSE_SET_REPORT, UT_WRITE_CLASS_INTERFACE):