* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
[not found] <CAAZOf24aXhyYd1pv0J63+2oLJ7K=yFFTXm_sE022-spCMMz6QQ@mail.gmail.com>
@ 2022-04-09 8:40 ` syzbot
2022-04-15 1:54 ` David Kahurani
0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2022-04-09 8:40 UTC (permalink / raw)
To: arnd, dan.carpenter, davem, glider, jackychou, jannh, jgg,
k.kahurani, kbuild-all, kuba, linux-kernel, linux-usb, lkp,
netdev, pabeni, paskripkin, phil, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
Tested on:
commit: 33d9269e Revert "kernel: kmsan: don't instrument stack..
git tree: https://github.com/google/kmsan.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873
dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1130ceb7700000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
2022-04-09 8:40 ` [syzbot] KMSAN: uninit-value in ax88179_led_setting syzbot
@ 2022-04-15 1:54 ` David Kahurani
2022-04-15 3:53 ` syzbot
0 siblings, 1 reply; 9+ messages in thread
From: David Kahurani @ 2022-04-15 1:54 UTC (permalink / raw)
To: syzbot
Cc: arnd, Dan Carpenter, davem, Alexander Potapenko, jackychou,
Jann Horn, jgg, kbuild-all, kuba, linux-kernel, linux-usb, lkp,
netdev, pabeni, Pavel Skripkin, Phillip Potter, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 1007 bytes --]
Made some changes, got to test this again just to be sure.
#syz test https://github.com/google/kmsan.git master
On Sat, Apr 9, 2022 at 11:40 AM syzbot
<syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 33d9269e Revert "kernel: kmsan: don't instrument stack..
> git tree: https://github.com/google/kmsan.git master
> kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873
> dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
> compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
> patch: https://syzkaller.appspot.com/x/patch.diff?x=1130ceb7700000
>
> Note: testing is done by a robot and is best-effort only.
[-- Attachment #2: 0001-net-ax88179-add-proper-error-handling-of-usb-read-er.patch --]
[-- Type: text/x-patch, Size: 17762 bytes --]
From 52430ebdbce0192019e1b354fb5cba487ebcfb09 Mon Sep 17 00:00:00 2001
From: David Kahurani <k.kahurani@gmail.com>
Date: Thu, 14 Apr 2022 15:16:02 +0300
Subject: [PATCH] net: ax88179: add proper error handling of usb read errors
Reads that are lesser than the requested size lead to uninit-value bugs.
An example of such a bug can be seen below whereby a local variable into
which the contents of reads were supposed to be stored is left
uninitialized after a partial read.
Qualify such reads as errors and handle them correctly.
Local variable eeprom.i created at:
ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline]
ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_bind+0xf00/0x1a50 drivers/net/usb/ax88179_178a.c:1412
Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to
gigabit ethernet adapter driver")
Signed-off-by: David Kahurani <k.kahurani@gmail.com>
Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
---
drivers/net/usb/ax88179_178a.c | 279 ++++++++++++++++++++++++++-------
1 file changed, 226 insertions(+), 53 deletions(-)
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index e2fa56b92..5113ed63f 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -185,8 +185,9 @@ static const struct {
{7, 0xcc, 0x4c, 0x18, 8},
};
-static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
- u16 size, void *data, int in_pm)
+static int __must_check __ax88179_read_cmd(struct usbnet *dev, u8 cmd,
+ u16 value, u16 index, u16 size,
+ void *data, int in_pm)
{
int ret;
int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);
@@ -201,11 +202,15 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
value, index, data, size);
- if (unlikely(ret < 0))
+ if (unlikely(ret < size)) {
+ ret = ret < 0 ? ret : -ENODATA;
+
netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
index, ret);
+ return ret;
+ }
- return ret;
+ return 0;
}
static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
@@ -249,26 +254,33 @@ static void ax88179_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value,
}
}
-static int ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
- u16 index, u16 size, void *data)
+static int __must_check ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd,
+ u16 value, u16 index, u16 size,
+ void *data)
{
int ret;
if (2 == size) {
u16 buf;
ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+ if (ret)
+ return ret;
le16_to_cpus(&buf);
*((u16 *)data) = buf;
} else if (4 == size) {
u32 buf;
ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+ if (ret)
+ return ret;
le32_to_cpus(&buf);
*((u32 *)data) = buf;
} else {
ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 1);
+ if (ret)
+ return ret;
}
- return ret;
+ return 0;
}
static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
@@ -290,26 +302,32 @@ static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
return ret;
}
-static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
- u16 size, void *data)
+static int __must_check ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value,
+ u16 index, u16 size, void *data)
{
int ret;
if (2 == size) {
u16 buf = 0;
ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+ if (ret)
+ return ret;
le16_to_cpus(&buf);
*((u16 *)data) = buf;
} else if (4 == size) {
u32 buf = 0;
ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+ if (ret)
+ return ret;
le32_to_cpus(&buf);
*((u32 *)data) = buf;
} else {
ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 0);
+ if (ret)
+ return ret;
}
- return ret;
+ return 0;
}
static int ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
@@ -354,8 +372,15 @@ static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc)
{
struct usbnet *dev = netdev_priv(netdev);
u16 res;
+ int ret;
+
+ ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret);
+ return ret;
+ }
- ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
return res;
}
@@ -416,7 +441,7 @@ ax88179_phy_write_mmd_indirect(struct usbnet *dev, u16 prtad, u16 devad,
ret = ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
MII_MMD_DATA, 2, &data);
- if (ret < 0)
+ if (ret)
return ret;
return 0;
@@ -427,19 +452,31 @@ static int ax88179_suspend(struct usb_interface *intf, pm_message_t message)
struct usbnet *dev = usb_get_intfdata(intf);
u16 tmp16;
u8 tmp8;
+ int ret;
usbnet_suspend(intf, message);
/* Disable RX path */
- ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
- 2, 2, &tmp16);
+ ret = ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+ 2, 2, &tmp16);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read MEDIUM_STATUS_MODE: %d\n",
+ ret);
+ return ret;
+ }
+
tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
2, 2, &tmp16);
/* Force bulk-in zero length */
- ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
- 2, 2, &tmp16);
+ ret = ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+ 2, 2, &tmp16);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read PHYPWR_RSTCTL: %d\n", ret);
+ return ret;
+ }
tmp16 |= AX_PHYPWR_RSTCTL_BZ | AX_PHYPWR_RSTCTL_IPRL;
ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
@@ -462,6 +499,7 @@ static int ax88179_auto_detach(struct usbnet *dev, int in_pm)
{
u16 tmp16;
u8 tmp8;
+ int ret;
int (*fnr)(struct usbnet *, u8, u16, u16, u16, void *);
int (*fnw)(struct usbnet *, u8, u16, u16, u16, const void *);
@@ -481,11 +519,19 @@ static int ax88179_auto_detach(struct usbnet *dev, int in_pm)
/* Enable Auto Detach bit */
tmp8 = 0;
- fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+ ret = fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read CLK_SELECT: %d", ret);
+ return ret;
+ }
tmp8 |= AX_CLK_SELECT_ULR;
fnw(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
- fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+ ret = fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read PHYPWR_RSTCTL: %d", ret);
+ return ret;
+ }
tmp16 |= AX_PHYPWR_RSTCTL_AT;
fnw(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
@@ -497,6 +543,7 @@ static int ax88179_resume(struct usb_interface *intf)
struct usbnet *dev = usb_get_intfdata(intf);
u16 tmp16;
u8 tmp8;
+ int ret;
usbnet_link_change(dev, 0, 0);
@@ -515,7 +562,14 @@ static int ax88179_resume(struct usb_interface *intf)
ax88179_auto_detach(dev, 1);
/* Enable clock */
- ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+ ret = ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read CLK_SELECT %d\n", ret);
+
+ return ret;
+ }
+
tmp8 |= AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
msleep(100);
@@ -601,7 +655,7 @@ ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
ret = __ax88179_read_cmd(dev, AX_ACCESS_EEPROM, i, 1, 2,
&eeprom_buff[i - first_word],
0);
- if (ret < 0) {
+ if (ret) {
kfree(eeprom_buff);
return -EIO;
}
@@ -645,7 +699,7 @@ ax88179_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
if (eeprom->offset & 1) {
ret = ax88179_read_cmd(dev, AX_ACCESS_EEPROM, first_word, 1, 2,
&eeprom_buff[0]);
- if (ret < 0) {
+ if (ret) {
netdev_err(net, "Failed to read EEPROM at offset 0x%02x.\n", first_word);
goto free;
}
@@ -654,7 +708,7 @@ ax88179_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
if ((eeprom->offset + eeprom->len) & 1) {
ret = ax88179_read_cmd(dev, AX_ACCESS_EEPROM, last_word, 1, 2,
&eeprom_buff[last_word - first_word]);
- if (ret < 0) {
+ if (ret) {
netdev_err(net, "Failed to read EEPROM at offset 0x%02x.\n", last_word);
goto free;
}
@@ -951,23 +1005,45 @@ static int
ax88179_set_features(struct net_device *net, netdev_features_t features)
{
u8 tmp;
+ int ret;
struct usbnet *dev = netdev_priv(net);
netdev_features_t changed = net->features ^ features;
if (changed & NETIF_F_IP_CSUM) {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL,
+ 1, 1, &tmp);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n",
+ ret);
+ return ret;
+ }
+
tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP;
ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
}
if (changed & NETIF_F_IPV6_CSUM) {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL,
+ 1, 1, &tmp);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n",
+ ret);
+ return ret;
+ }
+
tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
}
if (changed & NETIF_F_RXCSUM) {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL,
+ 1, 1, &tmp);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n",
+ ret);
+ return ret;
+ }
+
tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
@@ -980,19 +1056,36 @@ static int ax88179_change_mtu(struct net_device *net, int new_mtu)
{
struct usbnet *dev = netdev_priv(net);
u16 tmp16;
+ int ret;
net->mtu = new_mtu;
dev->hard_mtu = net->mtu + net->hard_header_len;
if (net->mtu > 1500) {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
- 2, 2, &tmp16);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC,
+ AX_MEDIUM_STATUS_MODE,
+ 2, 2, &tmp16);
+ if (ret) {
+ netdev_dbg(dev->net,
+ "Failed to read MEDIUM_STATUS_MODE %d\n",
+ ret);
+ return ret;
+ }
+
tmp16 |= AX_MEDIUM_JUMBO_EN;
ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
2, 2, &tmp16);
} else {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
- 2, 2, &tmp16);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC,
+ AX_MEDIUM_STATUS_MODE,
+ 2, 2, &tmp16);
+ if (ret) {
+ netdev_dbg(dev->net,
+ "Failed to read MEDIUM_STATUS_MODE %d\n",
+ ret);
+ return ret;
+ }
+
tmp16 &= ~AX_MEDIUM_JUMBO_EN;
ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
2, 2, &tmp16);
@@ -1045,6 +1138,7 @@ static int ax88179_check_eeprom(struct usbnet *dev)
u8 i, buf, eeprom[20];
u16 csum, delay = HZ / 10;
unsigned long jtimeout;
+ int ret;
/* Read EEPROM content */
for (i = 0; i < 6; i++) {
@@ -1060,16 +1154,29 @@ static int ax88179_check_eeprom(struct usbnet *dev)
jtimeout = jiffies + delay;
do {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
- 1, 1, &buf);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+ 1, 1, &buf);
+ if (ret) {
+ netdev_dbg(dev->net,
+ "Failed to read SROM_CMD: %d\n",
+ ret);
+ return ret;
+ }
if (time_after(jiffies, jtimeout))
return -EINVAL;
} while (buf & EEP_BUSY);
- __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
- 2, 2, &eeprom[i * 2], 0);
+ ret = __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+ 2, 2, &eeprom[i * 2], 0);
+
+ if (ret) {
+ netdev_dbg(dev->net,
+ "Failed to read SROM_DATA_LOW: %d\n",
+ ret);
+ return ret;
+ }
if ((i == 0) && (eeprom[0] == 0xFF))
return -EINVAL;
@@ -1149,12 +1256,20 @@ static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue)
static int ax88179_led_setting(struct usbnet *dev)
{
+ int ret;
u8 ledfd, value = 0;
u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10;
unsigned long jtimeout;
/* Check AX88179 version. UA1 or UA2*/
- ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1,
+ &value);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read GENERAL_STATUS: %d\n",
+ ret);
+ return ret;
+ }
if (!(value & AX_SECLD)) { /* UA1 */
value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN |
@@ -1178,20 +1293,39 @@ static int ax88179_led_setting(struct usbnet *dev)
jtimeout = jiffies + delay;
do {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
- 1, 1, &value);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+ 1, 1, &value);
+ if (ret) {
+ netdev_dbg(dev->net,
+ "Failed to read SROM_CMD: %d\n",
+ ret);
+ return ret;
+ }
if (time_after(jiffies, jtimeout))
return -EINVAL;
} while (value & EEP_BUSY);
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
- 1, 1, &value);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
+ 1, 1, &value);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read SROM_DATA_HIGH: %d\n",
+ ret);
+ return ret;
+ }
+
ledvalue = (value << 8);
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
- 1, 1, &value);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+ 1, 1, &value);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read SROM_DATA_LOW: %d",
+ ret);
+ return ret;
+ }
+
ledvalue |= value;
/* load internal ROM for defaule setting */
@@ -1213,11 +1347,21 @@ static int ax88179_led_setting(struct usbnet *dev)
ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
GMII_PHYPAGE, 2, &tmp);
- ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
- GMII_LED_ACT, 2, &ledact);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+ GMII_LED_ACT, 2, &ledact);
- ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
- GMII_LED_LINK, 2, &ledlink);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret);
+ return ret;
+ }
+
+ ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+ GMII_LED_LINK, 2, &ledlink);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret);
+ return ret;
+ }
ledact &= GMII_LED_ACTIVE_MASK;
ledlink &= GMII_LED_LINK_MASK;
@@ -1295,6 +1439,7 @@ static int ax88179_led_setting(struct usbnet *dev)
static void ax88179_get_mac_addr(struct usbnet *dev)
{
u8 mac[ETH_ALEN];
+ int ret;
memset(mac, 0, sizeof(mac));
@@ -1303,8 +1448,12 @@ static void ax88179_get_mac_addr(struct usbnet *dev)
netif_dbg(dev, ifup, dev->net,
"MAC address read from device tree");
} else {
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
- ETH_ALEN, mac);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+ ETH_ALEN, mac);
+
+ if (ret)
+ netdev_dbg(dev->net, "Failed to read NODE_ID: %d", ret);
+
netif_dbg(dev, ifup, dev->net,
"MAC address read from ASIX chip");
}
@@ -1572,6 +1721,7 @@ static int ax88179_link_reset(struct usbnet *dev)
u16 mode, tmp16, delay = HZ / 10;
u32 tmp32 = 0x40000000;
unsigned long jtimeout;
+ int ret;
jtimeout = jiffies + delay;
while (tmp32 & 0x40000000) {
@@ -1581,7 +1731,13 @@ static int ax88179_link_reset(struct usbnet *dev)
&ax179_data->rxctl);
/*link up, check the usb device control TX FIFO full or empty*/
- ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
+ ret = ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read TX FIFO: %d\n",
+ ret);
+ return ret;
+ }
if (time_after(jiffies, jtimeout))
return 0;
@@ -1590,11 +1746,21 @@ static int ax88179_link_reset(struct usbnet *dev)
mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
AX_MEDIUM_RXFLOW_CTRLEN;
- ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
- 1, 1, &link_sts);
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
+ 1, 1, &link_sts);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read LINK_STATUS: %d", ret);
+ return ret;
+ }
+
+ ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+ GMII_PHY_PHYSR, 2, &tmp16);
- ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
- GMII_PHY_PHYSR, 2, &tmp16);
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret);
+ return ret;
+ }
if (!(tmp16 & GMII_PHY_PHYSR_LINK)) {
return 0;
@@ -1732,9 +1898,16 @@ static int ax88179_reset(struct usbnet *dev)
static int ax88179_stop(struct usbnet *dev)
{
u16 tmp16;
+ int ret;
+
+ ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+ 2, 2, &tmp16);
+
+ if (ret) {
+ netdev_dbg(dev->net, "Failed to read STATUS_MODE: %d\n", ret);
+ return ret;
+ }
- ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
- 2, 2, &tmp16);
tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
2, 2, &tmp16);
--
2.25.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
2022-04-15 1:54 ` David Kahurani
@ 2022-04-15 3:53 ` syzbot
0 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2022-04-15 3:53 UTC (permalink / raw)
To: arnd, dan.carpenter, davem, glider, jackychou, jannh, jgg,
k.kahurani, kbuild-all, kuba, linux-kernel, linux-usb, lkp,
netdev, pabeni, paskripkin, phil, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
Tested on:
commit: 33d9269e Revert "kernel: kmsan: don't instrument stack..
git tree: https://github.com/google/kmsan.git master
kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873
dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=151cb868f00000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
2022-02-15 10:42 syzbot
@ 2022-04-07 2:41 ` syzbot
0 siblings, 0 replies; 9+ messages in thread
From: syzbot @ 2022-04-07 2:41 UTC (permalink / raw)
To: arnd, dan.carpenter, davem, glider, jackychou, jannh, jgg,
k.kahurani, kbuild-all, kuba, linux-kernel, linux-usb, lkp,
netdev, pabeni, paskripkin, phil, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 33d9269ef6e0 Revert "kernel: kmsan: don't instrument stack..
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=158ddbcf700000
kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873
dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=146e3dc3700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
ax88179_178a 2-1:0.252 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71
ax88179_178a 2-1:0.252 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71
=====================================================
BUG: KMSAN: uninit-value in ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline]
BUG: KMSAN: uninit-value in ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline]
ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_bind+0xf00/0x1a50 drivers/net/usb/ax88179_178a.c:1412
usbnet_probe+0x1251/0x4160 drivers/net/usb/usbnet.c:1747
usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
really_probe+0x653/0x14b0 drivers/base/dd.c:596
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:755
driver_probe_device drivers/base/dd.c:785 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:902
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:973
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1020
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1fff/0x26e0 drivers/base/core.c:3405
usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
really_probe+0x653/0x14b0 drivers/base/dd.c:596
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:755
driver_probe_device drivers/base/dd.c:785 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:902
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:973
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1020
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1fff/0x26e0 drivers/base/core.c:3405
usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
hub_port_connect drivers/usb/core/hub.c:5358 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
port_event drivers/usb/core/hub.c:5660 [inline]
hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
kthread+0x3c7/0x500 kernel/kthread.c:377
ret_from_fork+0x1f/0x30
Local variable eeprom.i created at:
ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline]
ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_bind+0xf00/0x1a50 drivers/net/usb/ax88179_178a.c:1412
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
=====================================================
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
2022-03-26 12:43 ` Pavel Skripkin
@ 2022-03-26 18:26 ` David Kahurani
0 siblings, 0 replies; 9+ messages in thread
From: David Kahurani @ 2022-03-26 18:26 UTC (permalink / raw)
To: Pavel Skripkin
Cc: davem, jgg, kuba, linux-kernel, linux-usb, netdev,
Phillip Potter, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311,
arnd
On Sat, Mar 26, 2022 at 3:43 PM Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> Hi David,
>
> On 3/26/22 14:47, David Kahurani wrote:
> >>
> >> Signed-off-by: David Kahurani <k.kahurani@gmail.com>
> >> Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
> >> ---
> >> drivers/net/usb/ax88179_178a.c | 181 +++++++++++++++++++++++++++------
> >> 1 file changed, 152 insertions(+), 29 deletions(-)
> >>
> >> diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
> >> index a31098981..932e21a65 100644
> >> --- a/drivers/net/usb/ax88179_178a.c
> >> +++ b/drivers/net/usb/ax88179_178a.c
> >> @@ -224,9 +224,12 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
> >> ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
> >> value, index, data, size);
> >>
>
Yes, this breaks the logic of the entire patch. It was a mistake. Will
fix that alongside your other comments.
> You've changed __ax88179_write_cmd(), but not __ax88179_read_cmd(). I've
> missed it. Changing __ax88179_write_cmd() does not help with uninit
> value bugs
>
> Also I believe, __ax88179_read_cmd() should have __must_check annotation
> too, since problem came from it in the first place (I mean after added
> sane error handling inside it)
>
> Next thing is ax88179_read_cmd_nopm() still prone to uninit value bugs,
> since it touches uninitialized `buf` in case of __ax88179_read_cmd()
> error...
>
>
>
> I remembered why I gave up on fixing this driver... I hope, you have
> more free time and motivation :)
>
>
>
>
> With regards,
> Pavel Skripkin
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
2022-03-26 11:47 ` David Kahurani
2022-03-26 12:10 ` Pavel Skripkin
@ 2022-03-26 12:43 ` Pavel Skripkin
2022-03-26 18:26 ` David Kahurani
1 sibling, 1 reply; 9+ messages in thread
From: Pavel Skripkin @ 2022-03-26 12:43 UTC (permalink / raw)
To: David Kahurani, davem, jgg, kuba, linux-kernel, linux-usb,
netdev, phil, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd
Hi David,
On 3/26/22 14:47, David Kahurani wrote:
>>
>> Signed-off-by: David Kahurani <k.kahurani@gmail.com>
>> Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
>> ---
>> drivers/net/usb/ax88179_178a.c | 181 +++++++++++++++++++++++++++------
>> 1 file changed, 152 insertions(+), 29 deletions(-)
>>
>> diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
>> index a31098981..932e21a65 100644
>> --- a/drivers/net/usb/ax88179_178a.c
>> +++ b/drivers/net/usb/ax88179_178a.c
>> @@ -224,9 +224,12 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
>> ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
>> value, index, data, size);
>>
You've changed __ax88179_write_cmd(), but not __ax88179_read_cmd(). I've
missed it. Changing __ax88179_write_cmd() does not help with uninit
value bugs
Also I believe, __ax88179_read_cmd() should have __must_check annotation
too, since problem came from it in the first place (I mean after added
sane error handling inside it)
Next thing is ax88179_read_cmd_nopm() still prone to uninit value bugs,
since it touches uninitialized `buf` in case of __ax88179_read_cmd()
error...
I remembered why I gave up on fixing this driver... I hope, you have
more free time and motivation :)
With regards,
Pavel Skripkin
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
2022-03-26 11:47 ` David Kahurani
@ 2022-03-26 12:10 ` Pavel Skripkin
2022-03-26 12:43 ` Pavel Skripkin
1 sibling, 0 replies; 9+ messages in thread
From: Pavel Skripkin @ 2022-03-26 12:10 UTC (permalink / raw)
To: David Kahurani, davem, jgg, kuba, linux-kernel, linux-usb,
netdev, phil, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd
Hi David,
On 3/26/22 14:47, David Kahurani wrote:
> Same here. My apologies.
>
> On Sat, Mar 26, 2022 at 2:28 PM David Kahurani <k.kahurani@gmail.com> wrote:
>>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range()
>> git tree: https://github.com/google/kmsan.git master
>> console output: https://syzkaller.appspot.com/x/log.txt?x=12d6c53c700000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a
>> dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
>> compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
>>
>> Based off a previous patch to fix a similar issue.
>> -------------------------
Looks sane.
Can you, please, send it as proper patch with explanation in commit
message and with a bit cutted log, since full ->probe() calltrace is not
interesting :)
With regards,
Pavel Skripkin
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting
[not found] <CAAZOf27PHWxdZifZpQYfTHb3h=qk22jRc6-A2LvBkLTR6xNOKg@mail.gmail.com>
@ 2022-03-26 11:47 ` David Kahurani
2022-03-26 12:10 ` Pavel Skripkin
2022-03-26 12:43 ` Pavel Skripkin
0 siblings, 2 replies; 9+ messages in thread
From: David Kahurani @ 2022-03-26 11:47 UTC (permalink / raw)
To: davem, jgg, kuba, linux-kernel, linux-usb, netdev, phil,
syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd
Same here. My apologies.
On Sat, Mar 26, 2022 at 2:28 PM David Kahurani <k.kahurani@gmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range()
> git tree: https://github.com/google/kmsan.git master
> console output: https://syzkaller.appspot.com/x/log.txt?x=12d6c53c700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a
> dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
> compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
>
> Based off a previous patch to fix a similar issue.
> -------------------------
>
> From: David Kahurani <k.kahurani@gmail.com>
> Date: Sat, 26 Mar 2022 14:19:47 +0300
> Subject: [PATCH] net: ax88179: add proper error handling of usb read errors
>
> ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71
> ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71
> =====================================================
> BUG: KMSAN: uninit-value in ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline]
> BUG: KMSAN: uninit-value in ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168
> ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline]
> ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168
> ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411
> usbnet_probe+0x1284/0x4140 drivers/net/usb/usbnet.c:1747
> usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
> really_probe+0x67d/0x1510 drivers/base/dd.c:596
> __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751
> driver_probe_device drivers/base/dd.c:781 [inline]
> __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898
> bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
> __device_attach+0x593/0x8e0 drivers/base/dd.c:969
> device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016
> bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
> device_add+0x1d3e/0x2400 drivers/base/core.c:3394
> usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
> usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
> usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
> really_probe+0x67d/0x1510 drivers/base/dd.c:596
> __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751
> driver_probe_device drivers/base/dd.c:781 [inline]
> __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898
> bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
> __device_attach+0x593/0x8e0 drivers/base/dd.c:969
> device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016
> bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
> device_add+0x1d3e/0x2400 drivers/base/core.c:3394
> usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2563
> hub_port_connect drivers/usb/core/hub.c:5353 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
> port_event drivers/usb/core/hub.c:5643 [inline]
> hub_event+0x5ad2/0x8910 drivers/usb/core/hub.c:5725
> process_one_work+0xdb9/0x1820 kernel/workqueue.c:2298
> process_scheduled_works kernel/workqueue.c:2361 [inline]
> worker_thread+0x1735/0x21f0 kernel/workqueue.c:2447
> kthread+0x721/0x850 kernel/kthread.c:327
> ret_from_fork+0x1f/0x30
>
> Local variable eeprom.i created at:
> ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline]
> ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168
> ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411
>
> CPU: 1 PID: 13457 Comm: kworker/1:0 Not tainted 5.16.0-rc5-syzkaller #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Workqueue: usb_hub_wq hub_event
> =====================================================
>
> Signed-off-by: David Kahurani <k.kahurani@gmail.com>
> Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
> ---
> drivers/net/usb/ax88179_178a.c | 181 +++++++++++++++++++++++++++------
> 1 file changed, 152 insertions(+), 29 deletions(-)
>
> diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
> index a31098981..932e21a65 100644
> --- a/drivers/net/usb/ax88179_178a.c
> +++ b/drivers/net/usb/ax88179_178a.c
> @@ -224,9 +224,12 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
> ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
> value, index, data, size);
>
> - if (unlikely(ret < 0))
> + if (unlikely(ret < size)) {
> + ret = ret < 0 ? ret : -ENODATA;
> +
> netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n",
> index, ret);
> + }
>
> return ret;
> }
> @@ -290,8 +293,8 @@ static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
> return ret;
> }
>
> -static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
> - u16 size, void *data)
> +static int __must_check ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value,
> + u16 index, u16 size, void *data)
> {
> int ret;
>
> @@ -354,8 +357,15 @@ static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc)
> {
> struct usbnet *dev = netdev_priv(netdev);
> u16 res;
> + int ret;
> +
> + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
> +
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret);
> + return ret;
> + }
>
> - ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
> return res;
> }
>
> @@ -951,23 +961,45 @@ static int
> ax88179_set_features(struct net_device *net, netdev_features_t features)
> {
> u8 tmp;
> + int ret;
> struct usbnet *dev = netdev_priv(net);
> netdev_features_t changed = net->features ^ features;
>
> if (changed & NETIF_F_IP_CSUM) {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL,
> + 1, 1, &tmp);
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n",
> + ret);
> + return ret;
> + }
> +
> tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP;
> ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
> }
>
> if (changed & NETIF_F_IPV6_CSUM) {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL,
> + 1, 1, &tmp);
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n",
> + ret);
> + return ret;
> + }
> +
> tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
> ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
> }
>
> if (changed & NETIF_F_RXCSUM) {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL,
> + 1, 1, &tmp);
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n",
> + ret);
> + return ret;
> + }
> +
> tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
> AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
> ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
> @@ -980,19 +1012,36 @@ static int ax88179_change_mtu(struct net_device *net, int new_mtu)
> {
> struct usbnet *dev = netdev_priv(net);
> u16 tmp16;
> + int ret;
>
> net->mtu = new_mtu;
> dev->hard_mtu = net->mtu + net->hard_header_len;
>
> if (net->mtu > 1500) {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> - 2, 2, &tmp16);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC,
> + AX_MEDIUM_STATUS_MODE,
> + 2, 2, &tmp16);
> + if (ret < 0){
> + netdev_dbg(dev->net,
> + "Failed to read MEDIUM_STATUS_MODE %d\n",
> + ret);
> + return ret;
> + }
> +
> tmp16 |= AX_MEDIUM_JUMBO_EN;
> ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> 2, 2, &tmp16);
> } else {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> - 2, 2, &tmp16);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC,
> + AX_MEDIUM_STATUS_MODE,
> + 2, 2, &tmp16);
> + if (ret < 0){
> + netdev_dbg(dev->net,
> + "Failed to read MEDIUM_STATUS_MODE %d\n",
> + ret);
> + return ret;
> + }
> +
> tmp16 &= ~AX_MEDIUM_JUMBO_EN;
> ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> 2, 2, &tmp16);
> @@ -1045,6 +1094,7 @@ static int ax88179_check_eeprom(struct usbnet *dev)
> u8 i, buf, eeprom[20];
> u16 csum, delay = HZ / 10;
> unsigned long jtimeout;
> + int ret;
>
> /* Read EEPROM content */
> for (i = 0; i < 6; i++) {
> @@ -1060,8 +1110,15 @@ static int ax88179_check_eeprom(struct usbnet *dev)
>
> jtimeout = jiffies + delay;
> do {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
> - 1, 1, &buf);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
> + 1, 1, &buf);
> +
> + if (ret < 0) {
> + netdev_dbg(dev->net,
> + "Failed to read SROM_CMD: %d\n",
> + ret);
> + return ret;
> + }
>
> if (time_after(jiffies, jtimeout))
> return -EINVAL;
> @@ -1149,12 +1206,19 @@ static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue)
>
> static int ax88179_led_setting(struct usbnet *dev)
> {
> + int ret;
> u8 ledfd, value = 0;
> u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10;
> unsigned long jtimeout;
>
> /* Check AX88179 version. UA1 or UA2*/
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value);
> +
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read GENERAL_STATUS: %d\n",
> + ret);
> + return ret;
> + }
>
> if (!(value & AX_SECLD)) { /* UA1 */
> value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN |
> @@ -1178,20 +1242,40 @@ static int ax88179_led_setting(struct usbnet *dev)
>
> jtimeout = jiffies + delay;
> do {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
> - 1, 1, &value);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
> + 1, 1, &value);
> + if (ret < 0){
> + netdev_dbg(dev->net,
> + "Failed to read SROM_CMD: %d\n",
> + ret);
> + return ret;
> + }
>
> if (time_after(jiffies, jtimeout))
> return -EINVAL;
>
> } while (value & EEP_BUSY);
>
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
> 1, 1, &value);
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read SROM_DATA_HIGH: %d\n",
> + ret);
> + return ret;
> + }
> +
> +
> ledvalue = (value << 8);
>
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
> - 1, 1, &value);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
> + 1, 1, &value);
> +
> + if (ret < 0) {
> + netdev_dbg(dev->net, "Failed to read SROM_DATA_LOW: %d",
> + ret);
> + return ret;
> + }
> +
> ledvalue |= value;
>
> /* load internal ROM for defaule setting */
> @@ -1213,12 +1297,22 @@ static int ax88179_led_setting(struct usbnet *dev)
> ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> GMII_PHYPAGE, 2, &tmp);
>
> - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> - GMII_LED_ACT, 2, &ledact);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> + GMII_LED_ACT, 2, &ledact);
> +
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret);
> + return ret;
> + }
>
> - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> GMII_LED_LINK, 2, &ledlink);
>
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret);
> + return ret;
> + }
> +
> ledact &= GMII_LED_ACTIVE_MASK;
> ledlink &= GMII_LED_LINK_MASK;
>
> @@ -1295,6 +1389,7 @@ static int ax88179_led_setting(struct usbnet *dev)
> static void ax88179_get_mac_addr(struct usbnet *dev)
> {
> u8 mac[ETH_ALEN];
> + int ret;
>
> memset(mac, 0, sizeof(mac));
>
> @@ -1303,8 +1398,12 @@ static void ax88179_get_mac_addr(struct usbnet *dev)
> netif_dbg(dev, ifup, dev->net,
> "MAC address read from device tree");
> } else {
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
> ETH_ALEN, mac);
> +
> + if (ret < 0)
> + netdev_dbg(dev->net, "Failed to read NODE_ID: %d", ret);
> +
> netif_dbg(dev, ifup, dev->net,
> "MAC address read from ASIX chip");
> }
> @@ -1572,6 +1671,7 @@ static int ax88179_link_reset(struct usbnet *dev)
> u16 mode, tmp16, delay = HZ / 10;
> u32 tmp32 = 0x40000000;
> unsigned long jtimeout;
> + int ret;
>
> jtimeout = jiffies + delay;
> while (tmp32 & 0x40000000) {
> @@ -1581,7 +1681,13 @@ static int ax88179_link_reset(struct usbnet *dev)
> &ax179_data->rxctl);
>
> /*link up, check the usb device control TX FIFO full or empty*/
> - ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
> + ret = ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
> +
> + if (ret < 0) {
> + netdev_dbg(dev->net, "Failed to read TX FIFO: %d\n",
> + ret);
> + return ret;
> + }
>
> if (time_after(jiffies, jtimeout))
> return 0;
> @@ -1590,11 +1696,21 @@ static int ax88179_link_reset(struct usbnet *dev)
> mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
> AX_MEDIUM_RXFLOW_CTRLEN;
>
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
> - 1, 1, &link_sts);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
> + 1, 1, &link_sts);
> +
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read LINK_STATUS: %d", ret);
> + return ret;
> + }
>
> - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> - GMII_PHY_PHYSR, 2, &tmp16);
> + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
> + GMII_PHY_PHYSR, 2, &tmp16);
> +
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret);
> + return ret;
> + }
>
> if (!(tmp16 & GMII_PHY_PHYSR_LINK)) {
> return 0;
> @@ -1732,9 +1848,16 @@ static int ax88179_reset(struct usbnet *dev)
> static int ax88179_stop(struct usbnet *dev)
> {
> u16 tmp16;
> + int ret;
>
> - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> 2, 2, &tmp16);
> +
> + if (ret < 0){
> + netdev_dbg(dev->net, "Failed to read STATUS_MODE: %d\n", ret);
> + return ret;
> + }
> +
> tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
> ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
> 2, 2, &tmp16);
> --
> 2.25.1
^ permalink raw reply [flat|nested] 9+ messages in thread
* [syzbot] KMSAN: uninit-value in ax88179_led_setting
@ 2022-02-15 10:42 syzbot
2022-04-07 2:41 ` syzbot
0 siblings, 1 reply; 9+ messages in thread
From: syzbot @ 2022-02-15 10:42 UTC (permalink / raw)
To: arnd, davem, glider, jgg, kuba, linux-kernel, linux-usb, netdev,
phil, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range()
git tree: https://github.com/google/kmsan.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=12d6c53c700000
kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a
dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311
compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com
ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71
ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71
=====================================================
BUG: KMSAN: uninit-value in ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline]
BUG: KMSAN: uninit-value in ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline]
ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411
usbnet_probe+0x1284/0x4140 drivers/net/usb/usbnet.c:1747
usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
really_probe+0x67d/0x1510 drivers/base/dd.c:596
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751
driver_probe_device drivers/base/dd.c:781 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:969
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1d3e/0x2400 drivers/base/core.c:3394
usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
really_probe+0x67d/0x1510 drivers/base/dd.c:596
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751
driver_probe_device drivers/base/dd.c:781 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:969
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1d3e/0x2400 drivers/base/core.c:3394
usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2563
hub_port_connect drivers/usb/core/hub.c:5353 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5497 [inline]
port_event drivers/usb/core/hub.c:5643 [inline]
hub_event+0x5ad2/0x8910 drivers/usb/core/hub.c:5725
process_one_work+0xdb9/0x1820 kernel/workqueue.c:2298
process_scheduled_works kernel/workqueue.c:2361 [inline]
worker_thread+0x1735/0x21f0 kernel/workqueue.c:2447
kthread+0x721/0x850 kernel/kthread.c:327
ret_from_fork+0x1f/0x30
Local variable eeprom.i created at:
ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline]
ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168
ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411
CPU: 1 PID: 13457 Comm: kworker/1:0 Not tainted 5.16.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: usb_hub_wq hub_event
=====================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2022-04-15 3:53 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAAZOf24aXhyYd1pv0J63+2oLJ7K=yFFTXm_sE022-spCMMz6QQ@mail.gmail.com>
2022-04-09 8:40 ` [syzbot] KMSAN: uninit-value in ax88179_led_setting syzbot
2022-04-15 1:54 ` David Kahurani
2022-04-15 3:53 ` syzbot
[not found] <CAAZOf27PHWxdZifZpQYfTHb3h=qk22jRc6-A2LvBkLTR6xNOKg@mail.gmail.com>
2022-03-26 11:47 ` David Kahurani
2022-03-26 12:10 ` Pavel Skripkin
2022-03-26 12:43 ` Pavel Skripkin
2022-03-26 18:26 ` David Kahurani
2022-02-15 10:42 syzbot
2022-04-07 2:41 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).