lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 831/862] usb: idmouse: fix an uninit-value in idmouse_open
    Date
    From: Dongliang Mu <mudongliangabcd@gmail.com>

    [ Upstream commit bce2b0539933e485d22d6f6f076c0fcd6f185c4c ]

    In idmouse_create_image, if any ftip_command fails, it will
    go to the reset label. However, this leads to the data in
    bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check
    for valid image incurs an uninitialized dereference.

    Fix this by moving the check before reset label since this
    check only be valid if the data after bulk_in_buffer[HEADER]
    has concrete data.

    Note that this is found by KMSAN, so only kernel compilation
    is tested.

    Reported-by: syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com
    Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
    Link: https://lore.kernel.org/r/20220922134847.1101921-1-dzm91@hust.edu.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/misc/idmouse.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
    index e9437a176518..ea39243efee3 100644
    --- a/drivers/usb/misc/idmouse.c
    +++ b/drivers/usb/misc/idmouse.c
    @@ -177,10 +177,6 @@ static int idmouse_create_image(struct usb_idmouse *dev)
    bytes_read += bulk_read;
    }

    - /* reset the device */
    -reset:
    - ftip_command(dev, FTIP_RELEASE, 0, 0);
    -
    /* check for valid image */
    /* right border should be black (0x00) */
    for (bytes_read = sizeof(HEADER)-1 + WIDTH-1; bytes_read < IMGSIZE; bytes_read += WIDTH)
    @@ -192,6 +188,10 @@ static int idmouse_create_image(struct usb_idmouse *dev)
    if (dev->bulk_in_buffer[bytes_read] != 0xFF)
    return -EAGAIN;

    + /* reset the device */
    +reset:
    + ftip_command(dev, FTIP_RELEASE, 0, 0);
    +
    /* should be IMGSIZE == 65040 */
    dev_dbg(&dev->interface->dev, "read %d bytes fingerprint data\n",
    bytes_read);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 13:06    [W:4.047 / U:1.548 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site