* [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read()
@ 2021-12-21 20:10 Pavel Skripkin
2021-12-21 20:10 ` [PATCH v2 2/2] asix: fix wrong return value in asix_check_host_enable() Pavel Skripkin
2021-12-22 23:00 ` [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read() patchwork-bot+netdevbpf
0 siblings, 2 replies; 4+ messages in thread
From: Pavel Skripkin @ 2021-12-21 20:10 UTC (permalink / raw)
To: davem, kuba, linux, andrew, robert.foss, freddy
Cc: linux-usb, netdev, linux-kernel, Pavel Skripkin,
syzbot+f44badb06036334e867a
asix_read_cmd() may read less than sizeof(smsr) bytes and in this case
smsr will be uninitialized.
Fail log:
BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]
BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497
BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497
asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]
asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497
asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497
Fixes: d9fe64e51114 ("net: asix: Add in_pm parameter")
Reported-and-tested-by: syzbot+f44badb06036334e867a@syzkaller.appspotmail.com
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
Changes in v2:
- Added Reviewed-by tag
---
drivers/net/usb/asix_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 42ba4af68090..06823d7141b6 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -77,7 +77,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)
0, 0, 1, &smsr, in_pm);
if (ret == -ENODEV)
break;
- else if (ret < 0)
+ else if (ret < sizeof(smsr))
continue;
else if (smsr & AX_HOST_EN)
break;
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH v2 2/2] asix: fix wrong return value in asix_check_host_enable()
2021-12-21 20:10 [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read() Pavel Skripkin
@ 2021-12-21 20:10 ` Pavel Skripkin
2021-12-21 20:11 ` Andrew Lunn
2021-12-22 23:00 ` [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read() patchwork-bot+netdevbpf
1 sibling, 1 reply; 4+ messages in thread
From: Pavel Skripkin @ 2021-12-21 20:10 UTC (permalink / raw)
To: davem, kuba, linux, andrew, robert.foss, freddy
Cc: linux-usb, netdev, linux-kernel, Pavel Skripkin
If asix_read_cmd() returns 0 on 30th interation, 0 will be returned from
asix_check_host_enable(), which is logically wrong. Fix it by returning
-ETIMEDOUT explicitly if we have exceeded 30 iterations
Also, replaced 30 with #define as suggested by Andrew
Fixes: a786e3195d6a ("net: asix: fix uninit value bugs")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
Changes in v2:
- Fixed coding style issues
- Replaced 30 with #define
---
drivers/net/usb/asix_common.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
index 06823d7141b6..71682970be58 100644
--- a/drivers/net/usb/asix_common.c
+++ b/drivers/net/usb/asix_common.c
@@ -9,6 +9,8 @@
#include "asix.h"
+#define AX_HOST_EN_RETRIES 30
+
int asix_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
u16 size, void *data, int in_pm)
{
@@ -68,7 +70,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)
int i, ret;
u8 smsr;
- for (i = 0; i < 30; ++i) {
+ for (i = 0; i < AX_HOST_EN_RETRIES; ++i) {
ret = asix_set_sw_mii(dev, in_pm);
if (ret == -ENODEV || ret == -ETIMEDOUT)
break;
@@ -83,7 +85,7 @@ static int asix_check_host_enable(struct usbnet *dev, int in_pm)
break;
}
- return ret;
+ return i >= AX_HOST_EN_RETRIES ? -ETIMEDOUT : ret;
}
static void reset_asix_rx_fixup_info(struct asix_rx_fixup_info *rx)
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2 2/2] asix: fix wrong return value in asix_check_host_enable()
2021-12-21 20:10 ` [PATCH v2 2/2] asix: fix wrong return value in asix_check_host_enable() Pavel Skripkin
@ 2021-12-21 20:11 ` Andrew Lunn
0 siblings, 0 replies; 4+ messages in thread
From: Andrew Lunn @ 2021-12-21 20:11 UTC (permalink / raw)
To: Pavel Skripkin
Cc: davem, kuba, linux, robert.foss, freddy, linux-usb, netdev, linux-kernel
On Tue, Dec 21, 2021 at 11:10:43PM +0300, Pavel Skripkin wrote:
> If asix_read_cmd() returns 0 on 30th interation, 0 will be returned from
> asix_check_host_enable(), which is logically wrong. Fix it by returning
> -ETIMEDOUT explicitly if we have exceeded 30 iterations
>
> Also, replaced 30 with #define as suggested by Andrew
>
> Fixes: a786e3195d6a ("net: asix: fix uninit value bugs")
> Reported-by: Andrew Lunn <andrew@lunn.ch>
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read()
2021-12-21 20:10 [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read() Pavel Skripkin
2021-12-21 20:10 ` [PATCH v2 2/2] asix: fix wrong return value in asix_check_host_enable() Pavel Skripkin
@ 2021-12-22 23:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-12-22 23:00 UTC (permalink / raw)
To: Pavel Skripkin
Cc: davem, kuba, linux, andrew, robert.foss, freddy, linux-usb,
netdev, linux-kernel, syzbot+f44badb06036334e867a
Hello:
This series was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 21 Dec 2021 23:10:36 +0300 you wrote:
> asix_read_cmd() may read less than sizeof(smsr) bytes and in this case
> smsr will be uninitialized.
>
> Fail log:
> BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]
> BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497
> BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497
> asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline]
> asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497
> asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497
>
> [...]
Here is the summary with links:
- [v2,1/2] asix: fix uninit-value in asix_mdio_read()
https://git.kernel.org/netdev/net/c/8035b1a2a37a
- [v2,2/2] asix: fix wrong return value in asix_check_host_enable()
https://git.kernel.org/netdev/net/c/d1652b70d07c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-12-22 23:00 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-21 20:10 [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read() Pavel Skripkin
2021-12-21 20:10 ` [PATCH v2 2/2] asix: fix wrong return value in asix_check_host_enable() Pavel Skripkin
2021-12-21 20:11 ` Andrew Lunn
2021-12-22 23:00 ` [PATCH v2 1/2] asix: fix uninit-value in asix_mdio_read() patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.