diff options
| author | Jack Bendtsen <jackdbendtsen@gmail.com> | 2025-06-19 17:40:31 +1000 |
|---|---|---|
| committer | Warner Losh <imp@FreeBSD.org> | 2026-01-09 13:17:13 -0700 |
| commit | 7631790422464de1aec309018e2c444defe5f629 (patch) | |
| tree | 9c24c3ea193699d1a3ac5b65e22778419522e735 /usr.sbin | |
| parent | 3e72ce4081f4a8d6b1d879dae201d569ce450261 (diff) | |
Fix NULL deref segfault in bhyve's usb_mouse.c
Some of the cases inside umouse_request() (usr.sbin/bhyve/usb_mouse.c)
use the data component of an event, while only partially checking if
it's NULL. 'data' has a NULL check, but then 'data' is immediately
deferenced anyway after the check regardless of if it's NULL or not.
For example:
case UREQ(UR_GET_STATUS, UT_READ_INTERFACE):
case UREQ(UR_GET_STATUS, UT_READ_ENDPOINT):
DPRINTF(("umouse: (UR_GET_STATUS, UT_READ_INTERFACE)"));
if (data != NULL && len > 1) {
USETW(udata, 0);
data->blen = len - 2;
data->bdone += 2;
}
eshort = data->blen > 0;
break;
There are actually four occurrences of this same bug, each in a
different case in this switch block.
Signed-off-by: Jack Bendtsen <jackdbendtsen@gmail.com>
PR: 282237
Reviewed by: imp, jhb, vexeduxr
MFC After: 1 week
Pull Request: https://github.com/freebsd/freebsd-src/pull/1728
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/bhyve/usb_mouse.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/usr.sbin/bhyve/usb_mouse.c b/usr.sbin/bhyve/usb_mouse.c index 82b1159d5f61..5caad886e082 100644 --- a/usr.sbin/bhyve/usb_mouse.c +++ b/usr.sbin/bhyve/usb_mouse.c @@ -538,7 +538,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer) data->bdone += 2; } - eshort = data->blen > 0; + eshort = data != NULL && data->blen > 0; break; case UREQ(UR_GET_STATUS, UT_READ_INTERFACE): @@ -549,7 +549,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer) data->blen = len - 2; data->bdone += 2; } - eshort = data->blen > 0; + eshort = data != NULL && data->blen > 0; break; case UREQ(UR_SET_ADDRESS, UT_WRITE_DEVICE): @@ -634,7 +634,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer) data->blen = len - 1; data->bdone += 1; } - eshort = data->blen > 0; + eshort = data != NULL && data->blen > 0; break; case UREQ(UMOUSE_GET_PROTOCOL, UT_READ_CLASS_INTERFACE): @@ -643,7 +643,7 @@ umouse_request(void *scarg, struct usb_data_xfer *xfer) data->blen = len - 1; data->bdone += 1; } - eshort = data->blen > 0; + eshort = data != NULL && data->blen > 0; break; case UREQ(UMOUSE_SET_REPORT, UT_WRITE_CLASS_INTERFACE): |