github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-08-11 09:54:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
09cbd1df7d
linux/drivers/net/usb
History
Pavel Skripkin af35fc3735 net: pegasus: fix uninit-value in get_interrupt_interval 
Syzbot reported uninit value pegasus_probe(). The problem was in missing
error handling.

get_interrupt_interval() internally calls read_eprom_word() which can
fail in some cases. For example: failed to receive usb control message.
These cases should be handled to prevent uninit value bug, since
read_eprom_word() will not initialize passed stack variable in case of
internal failure.

Fail log:

BUG: KMSAN: uninit-value in get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
BUG: KMSAN: uninit-value in pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
CPU: 1 PID: 825 Comm: kworker/1:1 Not tainted 5.12.0-rc6-syzkaller #0
...
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
 pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
....

Local variable ----data.i@pegasus_probe created at:
 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
 pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152
 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
 pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152

Reported-and-tested-by: syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20210804143005.439-1-paskripkin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-08-05 07:29:24 -07:00
..
aqc111.c net: usb: switch to dev_get_tstats64 and remove usbnet_get_stats64 alias 2020-11-12 14:58:27 -08:00
aqc111.h
asix_common.c net: usb: asix: add error handling for asix_mdio_* functions 2021-06-07 13:23:02 -07:00
asix_devices.c net: usb: asix: ax88772: suspend PHY on driver probe 2021-07-01 11:12:13 -07:00
asix.h net: usb: asix: ax88772: add generic selftest support 2021-06-07 13:23:02 -07:00
ax88172a.c net: usb: asix: ax88772: Fix less than zero comparison of a u16 2021-06-09 14:54:03 -07:00
ax88179_178a.c net: usb: ax88179_178a: initialize local variables before use 2021-04-01 16:09:37 -07:00
catc.c
cdc_eem.c net: cdc_eem: fix tx fixup skb leak 2021-06-17 11:30:25 -07:00
cdc_ether.c net: usb: Fix spelling mistakes 2021-06-01 17:05:05 -07:00
cdc_mbim.c net: usb: Fix spelling mistakes 2021-06-01 17:05:05 -07:00
cdc_ncm.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-06-18 19:47:02 -07:00
cdc_subset.c
cdc-phonet.c net: cdc-phonet: fix data-interface release on probe failure 2021-03-18 19:45:37 -07:00
ch9200.c
cx82310_eth.c cx82310_eth: fix error return code in cx82310_bind() 2020-11-16 15:23:44 -08:00
dm9601.c usbnet: add _mii suffix to usbnet_set/get_link_ksettings 2021-04-06 16:22:36 -07:00
gl620a.c
hso.c usb: hso: fix error handling code of hso_create_net_device 2021-07-15 12:36:21 -07:00
huawei_cdc_ncm.c usb: class: cdc-wdm: WWAN framework integration 2021-05-11 16:17:56 -07:00
int51x1.c net: usb: Fix spelling mistakes 2021-06-01 17:05:05 -07:00
ipheth.c usbnet: ipheth: fix connectivity with iOS 14 2020-11-21 14:01:34 -08:00
kalmia.c
kaweth.c
Kconfig net: usb: asix: ax88772: add generic selftest support 2021-06-07 13:23:02 -07:00
lan78xx.c net: usb: lan78xx: don't modify phy_device state concurrently 2021-08-04 12:51:14 +01:00
lan78xx.h
lg-vl600.c net: usb: Fix spelling mistakes 2021-06-01 17:05:05 -07:00
Makefile r8153_ecm: avoid to be prior to r8152 driver 2020-11-19 08:23:46 -08:00
mcs7830.c net: usb: remove leading spaces before tabs 2021-05-20 15:10:57 -07:00
net1080.c
pegasus.c net: pegasus: fix uninit-value in get_interrupt_interval 2021-08-05 07:29:24 -07:00
pegasus.h
plusb.c
qmi_wwan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-06-18 19:47:02 -07:00
r8152.c r8152: Fix a deadlock by doubly PM resume 2021-07-14 14:57:55 -07:00
r8153_ecm.c r8153_ecm: Add Lenovo Powered USB-C Hub as a fallback of r8152 2021-01-12 20:00:51 -08:00
rndis_host.c net: usb: Fix spelling mistakes 2021-06-01 17:05:05 -07:00
rtl8150.c net: usb: rtl8150: use new tasklet API 2021-02-02 15:51:18 -08:00
sierra_net.c usbnet: add _mii suffix to usbnet_set/get_link_ksettings 2021-04-06 16:22:36 -07:00
smsc75xx.c net: usb: fix possible use-after-free in smsc75xx_bind 2021-06-16 12:36:09 -07:00
smsc75xx.h
smsc95xx.c net: usb: switch to dev_get_tstats64 and remove usbnet_get_stats64 alias 2020-11-12 14:58:27 -08:00
smsc95xx.h
sr9700.c usbnet: add _mii suffix to usbnet_set/get_link_ksettings 2021-04-06 16:22:36 -07:00
sr9700.h
sr9800.c usbnet: add _mii suffix to usbnet_set/get_link_ksettings 2021-04-06 16:22:36 -07:00
sr9800.h
usbnet.c usbnet: add usbnet_event_names[] for kevent 2021-06-24 12:34:45 -07:00
zaurus.c