lkml.org 
[lkml]   [2021]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [syzbot] KMSAN: uninit-value in asix_mdio_read (2)
From
On 12/19/21 00:42, Andrew Lunn wrote:
> On Sun, Dec 19, 2021 at 12:14:30AM +0300, Pavel Skripkin wrote:
>> On 12/18/21 14:07, syzbot wrote:
>> > Hello,
>> >
>> > syzbot found the following issue on:
>> >
>> > HEAD commit: b0a8b5053e8b kmsan: core: add dependency on DEBUG_KERNEL
>> > git tree: https://github.com/google/kmsan.git master
>> > console output: https://syzkaller.appspot.com/x/log.txt?x=13a4d133b00000
>> > kernel config: https://syzkaller.appspot.com/x/.config?x=46a956fc7a887c60
>> > dashboard link: https://syzkaller.appspot.com/bug?extid=f44badb06036334e867a
>> > compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
>> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=149fddcbb00000
>> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17baef25b00000
>> >
>> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> > Reported-by: syzbot+f44badb06036334e867a@syzkaller.appspotmail.com
>> >
>>
>> The last unhanded case is asix_read_cmd() == 0. Let's handle it...
>
> That does not look correct, i think.
>
> asix_read_cmd() == 0 means no error from the read itself. If there is
> no error, we should look at the value of smsr and test for bit

As far as I understand asix_read_cmd() == 0 means 0 bytes was read,
since it just returns usb_control_msg() return value. I don't know if
usb_control_msg() can ever return 0, but looks like it's the only
unhanded case

> AX_HOST_EN. Doing a continue means we just ignore the value returned
> by the good read.
>
> I think the correct fix is to look at the value of i. If we have
> exceeded 30, we should return -ETIMEDOUT.
>

Sorry, I don't get how it can help. Report says, that on following line

else if (smsr & AX_HOST_EN)

smsr is uninitialized. How value of i can help here?

Can you, please, explain if you don't mind :)

Thanks


With regards,
Pavel Skripkin

\
 
 \ /
  Last update: 2021-12-18 23:02    [W:0.043 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site