* [PATCH 1/3] media: digitv: don't continue if remote control state can't be read
@ 2019-11-10 10:34 Sean Young
2019-11-10 10:34 ` [PATCH 2/3] media: af9005: uninitialized variable printked Sean Young
2019-11-10 10:34 ` [PATCH 3/3] media: vp7045: do not read uninitialized values if usb transfer fails Sean Young
0 siblings, 2 replies; 3+ messages in thread
From: Sean Young @ 2019-11-10 10:34 UTC (permalink / raw)
To: linux-media; +Cc: syzbot+6bf9606ee955b646c0e1
This results in an uninitialised variable read.
Reported-by: syzbot+6bf9606ee955b646c0e1@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
---
drivers/media/usb/dvb-usb/digitv.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index dd5bb230cec1..99a39339d45d 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -230,18 +230,22 @@ static struct rc_map_table rc_map_digitv_table[] = {
static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
{
- int i;
+ int ret, i;
u8 key[5];
u8 b[4] = { 0 };
*event = 0;
*state = REMOTE_NO_KEY_PRESSED;
- digitv_ctrl_msg(d,USB_READ_REMOTE,0,NULL,0,&key[1],4);
+ ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, &key[1], 4);
+ if (ret)
+ return ret;
/* Tell the device we've read the remote. Not sure how necessary
this is, but the Nebula SDK does it. */
- digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0);
+ ret = digitv_ctrl_msg(d, USB_WRITE_REMOTE, 0, b, 4, NULL, 0);
+ if (ret)
+ return ret;
/* if something is inside the buffer, simulate key press */
if (key[1] != 0)
--
2.23.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 2/3] media: af9005: uninitialized variable printked
2019-11-10 10:34 [PATCH 1/3] media: digitv: don't continue if remote control state can't be read Sean Young
@ 2019-11-10 10:34 ` Sean Young
2019-11-10 10:34 ` [PATCH 3/3] media: vp7045: do not read uninitialized values if usb transfer fails Sean Young
1 sibling, 0 replies; 3+ messages in thread
From: Sean Young @ 2019-11-10 10:34 UTC (permalink / raw)
To: linux-media; +Cc: syzbot+9d42b7773d2fecd983ab
If usb_bulk_msg() fails, actual_length can be uninitialized.
Reported-by: syzbot+9d42b7773d2fecd983ab@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
---
drivers/media/usb/dvb-usb/af9005.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
index ac93e88d7038..89b4b5d84cdf 100644
--- a/drivers/media/usb/dvb-usb/af9005.c
+++ b/drivers/media/usb/dvb-usb/af9005.c
@@ -554,7 +554,7 @@ static int af9005_boot_packet(struct usb_device *udev, int type, u8 *reply,
u8 *buf, int size)
{
u16 checksum;
- int act_len, i, ret;
+ int act_len = 0, i, ret;
memset(buf, 0, size);
buf[0] = (u8) (FW_BULKOUT_SIZE & 0xff);
--
2.23.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 3/3] media: vp7045: do not read uninitialized values if usb transfer fails
2019-11-10 10:34 [PATCH 1/3] media: digitv: don't continue if remote control state can't be read Sean Young
2019-11-10 10:34 ` [PATCH 2/3] media: af9005: uninitialized variable printked Sean Young
@ 2019-11-10 10:34 ` Sean Young
1 sibling, 0 replies; 3+ messages in thread
From: Sean Young @ 2019-11-10 10:34 UTC (permalink / raw)
To: linux-media; +Cc: syzbot+ec869945d3dde5f33b43
If reading the mac address or the remote control decoder state fails,
then this is not a fatal error.
Reported-by: syzbot+ec869945d3dde5f33b43@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
---
drivers/media/usb/dvb-usb/vp7045.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/vp7045.c b/drivers/media/usb/dvb-usb/vp7045.c
index 80c1cf05384b..2baf57216d19 100644
--- a/drivers/media/usb/dvb-usb/vp7045.c
+++ b/drivers/media/usb/dvb-usb/vp7045.c
@@ -96,10 +96,14 @@ static int vp7045_power_ctrl(struct dvb_usb_device *d, int onoff)
static int vp7045_rc_query(struct dvb_usb_device *d)
{
+ int ret;
u8 key;
- vp7045_usb_op(d,RC_VAL_READ,NULL,0,&key,1,20);
- deb_rc("remote query key: %x %d\n",key,key);
+ ret = vp7045_usb_op(d, RC_VAL_READ, NULL, 0, &key, 1, 20);
+ if (ret)
+ return ret;
+
+ deb_rc("remote query key: %x\n", key);
if (key != 0x44) {
/*
@@ -115,15 +119,18 @@ static int vp7045_rc_query(struct dvb_usb_device *d)
static int vp7045_read_eeprom(struct dvb_usb_device *d,u8 *buf, int len, int offset)
{
- int i = 0;
- u8 v,br[2];
+ int i, ret;
+ u8 v, br[2];
for (i=0; i < len; i++) {
v = offset + i;
- vp7045_usb_op(d,GET_EE_VALUE,&v,1,br,2,5);
+ ret = vp7045_usb_op(d, GET_EE_VALUE, &v, 1, br, 2, 5);
+ if (ret)
+ return ret;
+
buf[i] = br[1];
}
- deb_info("VP7045 EEPROM read (offs: %d, len: %d) : ",offset, i);
- debug_dump(buf,i,deb_info);
+ deb_info("VP7045 EEPROM read (offs: %d, len: %d) : ", offset, i);
+ debug_dump(buf, i, deb_info);
return 0;
}
--
2.23.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-11-10 10:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-10 10:34 [PATCH 1/3] media: digitv: don't continue if remote control state can't be read Sean Young
2019-11-10 10:34 ` [PATCH 2/3] media: af9005: uninitialized variable printked Sean Young
2019-11-10 10:34 ` [PATCH 3/3] media: vp7045: do not read uninitialized values if usb transfer fails Sean Young
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).