From patchwork Mon Oct 24 11:32:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 9398 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp478371wru; Mon, 24 Oct 2022 07:17:13 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6nJpOAulG4pzYQUaxad2bw91LW9QGXqEOKskk6O8IWXpIHg/sxE8ve96C/XO/5B8jOPwGl X-Received: by 2002:a17:906:cc0d:b0:78e:2c06:8e70 with SMTP id ml13-20020a170906cc0d00b0078e2c068e70mr27098075ejb.732.1666621033346; Mon, 24 Oct 2022 07:17:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666621033; cv=none; d=google.com; s=arc-20160816; b=o9bbqZFSMV0TBie8Gf6QFzDIK8dEi0Vy1wZHE0/D+Q1sOCgpZ2z06DVOS0ie1onng9 gl5S4qshYzsFbWs+mcyX7BqC98pU//jddrUvrOMZsHQhQRPhwkoap/m9J//sUfPHenKm pnW7rEvp8odNkYapdfBT8ohqdkY55fS+TQ0Ohe1a4hA+91e/1PrYy4dWAG9CqJSnMugz cnF53gma0tQ6CmOZogmM8Cge5vUDMdJZIaornLBddWK+WShkcksKWkDcA0SHoaX+iqJL 4fQJTwUe8rFG5CoXj0OHh4gmNXPviywetPjHs41+2A6JPbcKJra7bDj+iyKz3isBg+SQ ijUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=iEyLnsxdEbZpgMXxUMGXoRqchhpdzybvnC2uj9cSaYU=; b=BtR7+t8UNHPk59WtH53tpECrbBcT1IVAaiY1+qu68EzgFA0yYjcXt94w4vuDJboRSK gHzjcjI/ynXLI34kd1pDxLTERTs16ERVS9LP4pFbHRl37JqUbBhLRGWyLWoWxzUvB+r4 ZdtIcF8OSHrmwF7To4JT9fOahqDtZYwW5Hesvy9XRDXTdel7Or65xbzTHF5Nlsb21NWR lcm0zzZHvj1vD6vp8lPBsmH2pyHSJkVv063Z1PQt36kMFHMLKdOrqVYVm8eYI2s+ckZx qRiFhoxTJ6I0fxqbBLkHlC/3McXhoAit3SnkmDbXrACtktb8QM+ioQNPPCVWTSLXk6+d BT5w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=VfTAUdP0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y9-20020a056402270900b0045bc5ea5334si17402738edd.115.2022.10.24.07.16.48; Mon, 24 Oct 2022 07:17:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=VfTAUdP0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232338AbiJXOGF (ORCPT + 99 others); Mon, 24 Oct 2022 10:06:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234919AbiJXOCr (ORCPT ); Mon, 24 Oct 2022 10:02:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA616C06A6; Mon, 24 Oct 2022 05:48:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7C8B161290; Mon, 24 Oct 2022 12:32:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AE39C433D6; Mon, 24 Oct 2022 12:32:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666614735; bh=2ZxUg/1wAsgJI7Aj9gDfm/S13ITpUsPEtiIhR3IIIoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VfTAUdP0w3q9qjdQuIIFJ6fBLHXL408foK11KPrL5dY3cbC0shwxMJPYWX1+PePXx fFlIlaFFVlTEPXcDQbv7TLuGyGr0JCZPXPljCJCurBXg8KjQFONo/7ifrmH7RwQVly n/WfV80MxlcBHpiDJadb1lN1yd4gbc0Hx7xXKKSY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com, Dongliang Mu , Sasha Levin Subject: [PATCH 5.10 374/390] usb: idmouse: fix an uninit-value in idmouse_open Date: Mon, 24 Oct 2022 13:32:51 +0200 Message-Id: <20221024113038.944051888@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024113022.510008560@linuxfoundation.org> References: <20221024113022.510008560@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747578816708133353?= X-GMAIL-MSGID: =?utf-8?q?1747578816708133353?= From: Dongliang Mu [ Upstream commit bce2b0539933e485d22d6f6f076c0fcd6f185c4c ] In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested. Reported-by: syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu Link: https://lore.kernel.org/r/20220922134847.1101921-1-dzm91@hust.edu.cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/misc/idmouse.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c index e9437a176518..ea39243efee3 100644 --- a/drivers/usb/misc/idmouse.c +++ b/drivers/usb/misc/idmouse.c @@ -177,10 +177,6 @@ static int idmouse_create_image(struct usb_idmouse *dev) bytes_read += bulk_read; } - /* reset the device */ -reset: - ftip_command(dev, FTIP_RELEASE, 0, 0); - /* check for valid image */ /* right border should be black (0x00) */ for (bytes_read = sizeof(HEADER)-1 + WIDTH-1; bytes_read < IMGSIZE; bytes_read += WIDTH) @@ -192,6 +188,10 @@ static int idmouse_create_image(struct usb_idmouse *dev) if (dev->bulk_in_buffer[bytes_read] != 0xFF) return -EAGAIN; + /* reset the device */ +reset: + ftip_command(dev, FTIP_RELEASE, 0, 0); + /* should be IMGSIZE == 65040 */ dev_dbg(&dev->interface->dev, "read %d bytes fingerprint data\n", bytes_read);