* [PATCH] gspca: zero usb_buf on error
@ 2019-08-15 12:47 Hans Verkuil
2019-08-16 5:16 ` kbuild test robot
2019-08-16 5:48 ` kbuild test robot
0 siblings, 2 replies; 3+ messages in thread
From: Hans Verkuil @ 2019-08-15 12:47 UTC (permalink / raw)
To: Linux Media Mailing List
If reg_r() fails, then gspca_dev->usb_buf was left uninitialized,
and some drivers used the contents of that buffer in logic.
This caused several syzbot errors:
https://syzkaller.appspot.com/bug?extid=397fd082ce5143e2f67d
https://syzkaller.appspot.com/bug?extid=1a35278dd0ebfb3a038a
https://syzkaller.appspot.com/bug?extid=06ddf1788cfd048c5e82
I analyzed the gspca drivers and zeroed the buffer where needed.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-and-tested-by: syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com
---
diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
index d8e40137a204..53db9a2895ea 100644
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -114,6 +114,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index)
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, 2);
}
}
diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c
index 59649704beba..db3e1657670b 100644
--- a/drivers/media/usb/gspca/nw80x.c
+++ b/drivers/media/usb/gspca/nw80x.c
@@ -1572,6 +1572,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
return;
}
if (len == 1)
diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
index cfb1f53bc17e..f417dfc0b872 100644
--- a/drivers/media/usb/gspca/ov519.c
+++ b/drivers/media/usb/gspca/ov519.c
@@ -2073,6 +2073,11 @@ static int reg_r(struct sd *sd, u16 index)
} else {
gspca_err(gspca_dev, "reg_r %02x failed %d\n", index, ret);
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
return ret;
@@ -2101,6 +2106,11 @@ static int reg_r8(struct sd *sd,
} else {
gspca_err(gspca_dev, "reg_r8 %02x failed %d\n", index, ret);
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, 8);
}
return ret;
diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
index 56521c991db4..185c1f10fb30 100644
--- a/drivers/media/usb/gspca/ov534.c
+++ b/drivers/media/usb/gspca/ov534.c
@@ -693,6 +693,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
if (ret < 0) {
pr_err("read failed %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
return gspca_dev->usb_buf[0];
}
diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c
index 867f860a9650..91efc650cf76 100644
--- a/drivers/media/usb/gspca/ov534_9.c
+++ b/drivers/media/usb/gspca/ov534_9.c
@@ -1145,6 +1145,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg)
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ return 0;
}
return gspca_dev->usb_buf[0];
}
diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c
index 061deee138c3..e087cfb5980b 100644
--- a/drivers/media/usb/gspca/se401.c
+++ b/drivers/media/usb/gspca/se401.c
@@ -101,6 +101,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent)
pr_err("read req failed req %#04x error %d\n",
req, err);
gspca_dev->usb_err = err;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE);
}
}
diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c
index b43f89fee6c1..490af88e88ac 100644
--- a/drivers/media/usb/gspca/sn9c20x.c
+++ b/drivers/media/usb/gspca/sn9c20x.c
@@ -909,6 +909,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
if (unlikely(result < 0 || result != length)) {
pr_err("Read register %02x failed %d\n", reg, result);
gspca_dev->usb_err = result;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
}
}
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 046fc2c2a135..4d655e2da9cb 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -453,6 +453,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
dev_err(gspca_dev->v4l2_dev.dev,
"Error reading register %02x: %d\n", value, res);
gspca_dev->usb_err = res;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
}
diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
index 50a6c8425827..acf931a2bf1f 100644
--- a/drivers/media/usb/gspca/sonixj.c
+++ b/drivers/media/usb/gspca/sonixj.c
@@ -1162,6 +1162,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
}
}
diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c
index 2ae03b60163f..ec1811895f85 100644
--- a/drivers/media/usb/gspca/spca1528.c
+++ b/drivers/media/usb/gspca/spca1528.c
@@ -71,6 +71,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
}
}
diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c
index d1ba0888d798..cd9bf31ed437 100644
--- a/drivers/media/usb/gspca/sq930x.c
+++ b/drivers/media/usb/gspca/sq930x.c
@@ -425,6 +425,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r %04x failed %d\n", value, ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
}
}
diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index d0ddfa957ca9..0648d0db5515 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -255,6 +255,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
}
}
diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c
index 588a847ea483..e652a6becb3e 100644
--- a/drivers/media/usb/gspca/vc032x.c
+++ b/drivers/media/usb/gspca/vc032x.c
@@ -2906,6 +2906,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
}
}
static void reg_r(struct gspca_dev *gspca_dev,
diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c
index 16b679c2de21..a8350ee9712f 100644
--- a/drivers/media/usb/gspca/w996Xcf.c
+++ b/drivers/media/usb/gspca/w996Xcf.c
@@ -133,6 +133,11 @@ static int w9968cf_read_sb(struct sd *sd)
} else {
pr_err("Read SB reg [01] failed\n");
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(sd->gspca_dev.usb_buf, 0, 2);
}
udelay(W9968CF_I2C_BUS_DELAY);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] gspca: zero usb_buf on error
2019-08-15 12:47 [PATCH] gspca: zero usb_buf on error Hans Verkuil
@ 2019-08-16 5:16 ` kbuild test robot
2019-08-16 5:48 ` kbuild test robot
1 sibling, 0 replies; 3+ messages in thread
From: kbuild test robot @ 2019-08-16 5:16 UTC (permalink / raw)
To: Hans Verkuil; +Cc: kbuild-all, Linux Media Mailing List
[-- Attachment #1: Type: text/plain, Size: 4830 bytes --]
Hi Hans,
I love your patch! Perhaps something to improve:
[auto build test WARNING on linuxtv-media/master]
[cannot apply to v5.3-rc4 next-20190814]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Hans-Verkuil/gspca-zero-usb_buf-on-error/20190816-123155
base: git://linuxtv.org/media_tree.git master
config: ia64-allmodconfig (attached as .config)
compiler: ia64-linux-gcc (GCC) 7.4.0
reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=7.4.0 make.cross ARCH=ia64
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
drivers/media/usb/gspca/nw80x.c: In function 'reg_r':
>> drivers/media/usb/gspca/nw80x.c:1579:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
--
drivers/media/usb/gspca/sn9c20x.c: In function 'reg_r':
>> drivers/media/usb/gspca/sn9c20x.c:916:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
--
drivers/media/usb/gspca/sonixj.c: In function 'reg_r':
>> drivers/media/usb/gspca/sonixj.c:1169:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
--
drivers/media/usb/gspca/spca1528.c: In function 'reg_r':
>> drivers/media/usb/gspca/spca1528.c:78:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
--
drivers/media/usb/gspca/sq930x.c: In function 'reg_r':
>> drivers/media/usb/gspca/sq930x.c:432:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
--
drivers/media/usb/gspca/sunplus.c: In function 'reg_r':
>> drivers/media/usb/gspca/sunplus.c:262:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
--
drivers/media/usb/gspca/vc032x.c: In function 'reg_r_i':
>> drivers/media/usb/gspca/vc032x.c:2913:39: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
vim +1579 drivers/media/usb/gspca/nw80x.c
1556
1557 /* -- read registers in usb_buf -- */
1558 static void reg_r(struct gspca_dev *gspca_dev,
1559 u16 index,
1560 int len)
1561 {
1562 struct usb_device *dev = gspca_dev->dev;
1563 int ret;
1564
1565 if (gspca_dev->usb_err < 0)
1566 return;
1567 ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
1568 0x00,
1569 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1570 0x00, index,
1571 gspca_dev->usb_buf, len, 500);
1572 if (ret < 0) {
1573 pr_err("reg_r err %d\n", ret);
1574 gspca_dev->usb_err = ret;
1575 /*
1576 * Make sure the buffer is zeroed to avoid uninitialized
1577 * values.
1578 */
> 1579 memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
1580 return;
1581 }
1582 if (len == 1)
1583 gspca_dbg(gspca_dev, D_USBI, "GET 00 0000 %04x %02x\n",
1584 index, gspca_dev->usb_buf[0]);
1585 else
1586 gspca_dbg(gspca_dev, D_USBI, "GET 00 0000 %04x %02x %02x ..\n",
1587 index, gspca_dev->usb_buf[0],
1588 gspca_dev->usb_buf[1]);
1589 }
1590
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 54560 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] gspca: zero usb_buf on error
2019-08-15 12:47 [PATCH] gspca: zero usb_buf on error Hans Verkuil
2019-08-16 5:16 ` kbuild test robot
@ 2019-08-16 5:48 ` kbuild test robot
1 sibling, 0 replies; 3+ messages in thread
From: kbuild test robot @ 2019-08-16 5:48 UTC (permalink / raw)
To: Hans Verkuil; +Cc: kbuild-all, Linux Media Mailing List
[-- Attachment #1: Type: text/plain, Size: 10259 bytes --]
Hi Hans,
I love your patch! Perhaps something to improve:
[auto build test WARNING on linuxtv-media/master]
[cannot apply to v5.3-rc4 next-20190814]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Hans-Verkuil/gspca-zero-usb_buf-on-error/20190816-123155
base: git://linuxtv.org/media_tree.git master
config: sparc64-allmodconfig (attached as .config)
compiler: sparc64-linux-gcc (GCC) 7.4.0
reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=7.4.0 make.cross ARCH=sparc64
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/nodemask.h:95,
from include/linux/mmzone.h:17,
from include/linux/gfp.h:6,
from include/linux/umh.h:4,
from include/linux/kmod.h:9,
from include/linux/module.h:13,
from drivers/media/usb/gspca/gspca.h:5,
from drivers/media/usb/gspca/nw80x.c:14:
drivers/media/usb/gspca/nw80x.c: In function 'reg_r':
>> drivers/media/usb/gspca/nw80x.c:1579:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
--
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/cpumask.h:12,
from include/linux/rcupdate.h:31,
from include/linux/radix-tree.h:15,
from include/linux/idr.h:15,
from include/linux/kernfs.h:13,
from include/linux/sysfs.h:16,
from include/linux/kobject.h:20,
from include/linux/device.h:16,
from include/linux/input.h:19,
from drivers/media/usb/gspca/sn9c20x.c:12:
drivers/media/usb/gspca/sn9c20x.c: In function 'reg_r':
>> drivers/media/usb/gspca/sn9c20x.c:916:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
--
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/cpumask.h:12,
from include/linux/rcupdate.h:31,
from include/linux/radix-tree.h:15,
from include/linux/idr.h:15,
from include/linux/kernfs.h:13,
from include/linux/sysfs.h:16,
from include/linux/kobject.h:20,
from include/linux/device.h:16,
from include/linux/input.h:19,
from drivers/media/usb/gspca/sonixj.c:13:
drivers/media/usb/gspca/sonixj.c: In function 'reg_r':
>> drivers/media/usb/gspca/sonixj.c:1169:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
--
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/nodemask.h:95,
from include/linux/mmzone.h:17,
from include/linux/gfp.h:6,
from include/linux/umh.h:4,
from include/linux/kmod.h:9,
from include/linux/module.h:13,
from drivers/media/usb/gspca/gspca.h:5,
from drivers/media/usb/gspca/spca1528.c:12:
drivers/media/usb/gspca/spca1528.c: In function 'reg_r':
>> drivers/media/usb/gspca/spca1528.c:78:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
--
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/nodemask.h:95,
from include/linux/mmzone.h:17,
from include/linux/gfp.h:6,
from include/linux/umh.h:4,
from include/linux/kmod.h:9,
from include/linux/module.h:13,
from drivers/media/usb/gspca/gspca.h:5,
from drivers/media/usb/gspca/sq930x.c:14:
drivers/media/usb/gspca/sq930x.c: In function 'reg_r':
>> drivers/media/usb/gspca/sq930x.c:432:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
--
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/nodemask.h:95,
from include/linux/mmzone.h:17,
from include/linux/gfp.h:6,
from include/linux/umh.h:4,
from include/linux/kmod.h:9,
from include/linux/module.h:13,
from drivers/media/usb/gspca/gspca.h:5,
from drivers/media/usb/gspca/sunplus.c:13:
drivers/media/usb/gspca/sunplus.c: In function 'reg_r':
>> drivers/media/usb/gspca/sunplus.c:262:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
--
In file included from include/linux/string.h:20:0,
from include/linux/bitmap.h:9,
from include/linux/nodemask.h:95,
from include/linux/mmzone.h:17,
from include/linux/gfp.h:6,
from include/linux/umh.h:4,
from include/linux/kmod.h:9,
from include/linux/module.h:13,
from drivers/media/usb/gspca/gspca.h:5,
from drivers/media/usb/gspca/vc032x.c:14:
drivers/media/usb/gspca/vc032x.c: In function 'reg_r_i':
>> drivers/media/usb/gspca/vc032x.c:2913:39: warning: argument to 'sizeof' in '__builtin_memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess]
memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
^
arch/sparc/include/asm/string.h:18:52: note: in definition of macro 'memset'
#define memset(s, c, count) __builtin_memset(s, c, count)
^~~~~
vim +1579 drivers/media/usb/gspca/nw80x.c
1556
1557 /* -- read registers in usb_buf -- */
1558 static void reg_r(struct gspca_dev *gspca_dev,
1559 u16 index,
1560 int len)
1561 {
1562 struct usb_device *dev = gspca_dev->dev;
1563 int ret;
1564
1565 if (gspca_dev->usb_err < 0)
1566 return;
1567 ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
1568 0x00,
1569 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
1570 0x00, index,
1571 gspca_dev->usb_buf, len, 500);
1572 if (ret < 0) {
1573 pr_err("reg_r err %d\n", ret);
1574 gspca_dev->usb_err = ret;
1575 /*
1576 * Make sure the buffer is zeroed to avoid uninitialized
1577 * values.
1578 */
> 1579 memset(gspca_dev->usb_buf, 0, sizeof(gspca_dev->usb_buf));
1580 return;
1581 }
1582 if (len == 1)
1583 gspca_dbg(gspca_dev, D_USBI, "GET 00 0000 %04x %02x\n",
1584 index, gspca_dev->usb_buf[0]);
1585 else
1586 gspca_dbg(gspca_dev, D_USBI, "GET 00 0000 %04x %02x %02x ..\n",
1587 index, gspca_dev->usb_buf[0],
1588 gspca_dev->usb_buf[1]);
1589 }
1590
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 58651 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-08-16 5:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-15 12:47 [PATCH] gspca: zero usb_buf on error Hans Verkuil
2019-08-16 5:16 ` kbuild test robot
2019-08-16 5:48 ` kbuild test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).