From patchwork Sat Oct 22 07:29:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7718 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1109885wrr; Sat, 22 Oct 2022 01:50:25 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5ZgIKAwEI4dZ9RNjTePSGm7P9lenaENjcJ6738Lyxcz4YBc0D1y2bdne9AxSmXR1arhUBz X-Received: by 2002:a05:6402:5ca:b0:445:c80a:3c2 with SMTP id n10-20020a05640205ca00b00445c80a03c2mr21315159edx.247.1666428625544; Sat, 22 Oct 2022 01:50:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666428625; cv=none; d=google.com; s=arc-20160816; b=tuG8x0UC43TAsn9xOoyoDp8ufYQrpb0ix4IXc0A/EmbFic0txlR2rF8Jj7zRn866qx T4cC9aoGlMoepTRR28xMrLgrvTHmp6mCmvVHjywFdmTXoWM0oXX/Qrh2+XgyyGDbc+4X tk3fJ0t3MDPGgnej76/YIKlwgfG+M5d8F3mzE4CSQe/9xxJVC4ykpVyEyfCQ/c8151Xw anu5MUrOVofCRkhA15Jbsz9rDRxpqkQ7vAX5r2DSRGj8XXjl9f9K3rGOIzPrMa6n4FHr vBkscwC+u2/P7sV1eTUf8hAyR7B5PMTh5Xdf1klT6a+pm8QFurEF9HaXKN8ack9CJnmo bdXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=iEyLnsxdEbZpgMXxUMGXoRqchhpdzybvnC2uj9cSaYU=; b=CIdUKwmGhQJawLwiwNx/iZzek8s+/6z/OInEPWSVEG+vF65+Qfn/gz1QRUW0TS8tKi P/Z0EFC3482F67LrDybJP27KU6fY4RcwDD0g0Qlvwpx8bXm9Vuo82NngIvHWov07m8AS vby6fP+vyFJ09gW+rWbrAHS8tF75iL4Qb1rFJN+KAtXkwmndmkfNk9JzvQz+IeK0p4a+ uJ9zlcTaTpyVs26qADn+kPfn4r/NvBdlhC82LYZ/ld96iTnRxXuXzQg38Su7QsBEP6h6 TLHVAV1ep1ovun9F+eyTNPjyHpIOMyjERfHeHbL8lxy/pC3SpzkkedtpuPuvHiqVjY5q KZMg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=k5Ok7wZa; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w10-20020a056402268a00b0045d25cf222csi23965805edd.362.2022.10.22.01.50.01; Sat, 22 Oct 2022 01:50:25 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=k5Ok7wZa; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234200AbiJVIs3 (ORCPT + 99 others); Sat, 22 Oct 2022 04:48:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44002 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235374AbiJVIp0 (ORCPT ); Sat, 22 Oct 2022 04:45:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28EB83471D; Sat, 22 Oct 2022 01:09:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4F5A460AD9; Sat, 22 Oct 2022 08:08:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BD5CC43141; Sat, 22 Oct 2022 08:08:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666426099; bh=2ZxUg/1wAsgJI7Aj9gDfm/S13ITpUsPEtiIhR3IIIoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k5Ok7wZantfD4RIXKjX+UI3KFuQcin5WnUzHFAyAloBbiG1i7w0V5FrlkoBdhY6ST xG1NK3S+ChwPgVqes5/crG265Zhigf+x4rJgMyFvconX7Qgb7FFFe/s6qtjpX9Ev7y j1vy2AYezYAxeQsw2oP7VFpRZX7a54f0OGQWk+FM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com, Dongliang Mu , Sasha Levin Subject: [PATCH 5.19 688/717] usb: idmouse: fix an uninit-value in idmouse_open Date: Sat, 22 Oct 2022 09:29:27 +0200 Message-Id: <20221022072528.929522756@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747377062509074017?= X-GMAIL-MSGID: =?utf-8?q?1747377062509074017?= From: Dongliang Mu [ Upstream commit bce2b0539933e485d22d6f6f076c0fcd6f185c4c ] In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested. Reported-by: syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu Link: https://lore.kernel.org/r/20220922134847.1101921-1-dzm91@hust.edu.cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/misc/idmouse.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c index e9437a176518..ea39243efee3 100644 --- a/drivers/usb/misc/idmouse.c +++ b/drivers/usb/misc/idmouse.c @@ -177,10 +177,6 @@ static int idmouse_create_image(struct usb_idmouse *dev) bytes_read += bulk_read; } - /* reset the device */ -reset: - ftip_command(dev, FTIP_RELEASE, 0, 0); - /* check for valid image */ /* right border should be black (0x00) */ for (bytes_read = sizeof(HEADER)-1 + WIDTH-1; bytes_read < IMGSIZE; bytes_read += WIDTH) @@ -192,6 +188,10 @@ static int idmouse_create_image(struct usb_idmouse *dev) if (dev->bulk_in_buffer[bytes_read] != 0xFF) return -EAGAIN; + /* reset the device */ +reset: + ftip_command(dev, FTIP_RELEASE, 0, 0); + /* should be IMGSIZE == 65040 */ dev_dbg(&dev->interface->dev, "read %d bytes fingerprint data\n", bytes_read);