* [syzbot] KMSAN: uninit-value in ax88179_led_setting @ 2022-02-15 10:42 syzbot 2022-04-07 2:41 ` syzbot 0 siblings, 1 reply; 9+ messages in thread From: syzbot @ 2022-02-15 10:42 UTC (permalink / raw) To: arnd, davem, glider, jgg, kuba, linux-kernel, linux-usb, netdev, phil, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range() git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=12d6c53c700000 kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71 ===================================================== BUG: KMSAN: uninit-value in ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline] BUG: KMSAN: uninit-value in ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline] ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411 usbnet_probe+0x1284/0x4140 drivers/net/usb/usbnet.c:1747 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x67d/0x1510 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751 driver_probe_device drivers/base/dd.c:781 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:969 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1d3e/0x2400 drivers/base/core.c:3394 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x67d/0x1510 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751 driver_probe_device drivers/base/dd.c:781 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:969 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1d3e/0x2400 drivers/base/core.c:3394 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2563 hub_port_connect drivers/usb/core/hub.c:5353 [inline] hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] port_event drivers/usb/core/hub.c:5643 [inline] hub_event+0x5ad2/0x8910 drivers/usb/core/hub.c:5725 process_one_work+0xdb9/0x1820 kernel/workqueue.c:2298 process_scheduled_works kernel/workqueue.c:2361 [inline] worker_thread+0x1735/0x21f0 kernel/workqueue.c:2447 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 Local variable eeprom.i created at: ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline] ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411 CPU: 1 PID: 13457 Comm: kworker/1:0 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event ===================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting 2022-02-15 10:42 [syzbot] KMSAN: uninit-value in ax88179_led_setting syzbot @ 2022-04-07 2:41 ` syzbot 0 siblings, 0 replies; 9+ messages in thread From: syzbot @ 2022-04-07 2:41 UTC (permalink / raw) To: arnd, dan.carpenter, davem, glider, jackychou, jannh, jgg, k.kahurani, kbuild-all, kuba, linux-kernel, linux-usb, lkp, netdev, pabeni, paskripkin, phil, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 33d9269ef6e0 Revert "kernel: kmsan: don't instrument stack.. git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=158ddbcf700000 kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873 dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=146e3dc3700000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com ax88179_178a 2-1:0.252 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 ax88179_178a 2-1:0.252 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71 ===================================================== BUG: KMSAN: uninit-value in ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline] BUG: KMSAN: uninit-value in ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline] ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_bind+0xf00/0x1a50 drivers/net/usb/ax88179_178a.c:1412 usbnet_probe+0x1251/0x4160 drivers/net/usb/usbnet.c:1747 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:755 driver_probe_device drivers/base/dd.c:785 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:902 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:973 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1020 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:755 driver_probe_device drivers/base/dd.c:785 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:902 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:973 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1020 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 Local variable eeprom.i created at: ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline] ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_bind+0xf00/0x1a50 drivers/net/usb/ax88179_178a.c:1412 CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.17.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event ===================================================== ^ permalink raw reply [flat|nested] 9+ messages in thread
[parent not found: <CAAZOf27PHWxdZifZpQYfTHb3h=qk22jRc6-A2LvBkLTR6xNOKg@mail.gmail.com>]
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting [not found] <CAAZOf27PHWxdZifZpQYfTHb3h=qk22jRc6-A2LvBkLTR6xNOKg@mail.gmail.com> @ 2022-03-26 11:47 ` David Kahurani 2022-03-26 12:10 ` Pavel Skripkin 2022-03-26 12:43 ` Pavel Skripkin 0 siblings, 2 replies; 9+ messages in thread From: David Kahurani @ 2022-03-26 11:47 UTC (permalink / raw) To: davem, jgg, kuba, linux-kernel, linux-usb, netdev, phil, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd Same here. My apologies. On Sat, Mar 26, 2022 at 2:28 PM David Kahurani <k.kahurani@gmail.com> wrote: > > Hello, > > syzbot found the following issue on: > > HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range() > git tree: https://github.com/google/kmsan.git master > console output: https://syzkaller.appspot.com/x/log.txt?x=12d6c53c700000 > kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a > dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 > compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 > > Based off a previous patch to fix a similar issue. > ------------------------- > > From: David Kahurani <k.kahurani@gmail.com> > Date: Sat, 26 Mar 2022 14:19:47 +0300 > Subject: [PATCH] net: ax88179: add proper error handling of usb read errors > > ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 > ax88179_178a 2-1:0.35 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71 > ===================================================== > BUG: KMSAN: uninit-value in ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline] > BUG: KMSAN: uninit-value in ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168 > ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1074 [inline] > ax88179_led_setting+0x884/0x30b0 drivers/net/usb/ax88179_178a.c:1168 > ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411 > usbnet_probe+0x1284/0x4140 drivers/net/usb/usbnet.c:1747 > usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 > really_probe+0x67d/0x1510 drivers/base/dd.c:596 > __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751 > driver_probe_device drivers/base/dd.c:781 [inline] > __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898 > bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 > __device_attach+0x593/0x8e0 drivers/base/dd.c:969 > device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016 > bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 > device_add+0x1d3e/0x2400 drivers/base/core.c:3394 > usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 > usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 > usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 > really_probe+0x67d/0x1510 drivers/base/dd.c:596 > __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:751 > driver_probe_device drivers/base/dd.c:781 [inline] > __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:898 > bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 > __device_attach+0x593/0x8e0 drivers/base/dd.c:969 > device_initial_probe+0x4a/0x60 drivers/base/dd.c:1016 > bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 > device_add+0x1d3e/0x2400 drivers/base/core.c:3394 > usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2563 > hub_port_connect drivers/usb/core/hub.c:5353 [inline] > hub_port_connect_change drivers/usb/core/hub.c:5497 [inline] > port_event drivers/usb/core/hub.c:5643 [inline] > hub_event+0x5ad2/0x8910 drivers/usb/core/hub.c:5725 > process_one_work+0xdb9/0x1820 kernel/workqueue.c:2298 > process_scheduled_works kernel/workqueue.c:2361 [inline] > worker_thread+0x1735/0x21f0 kernel/workqueue.c:2447 > kthread+0x721/0x850 kernel/kthread.c:327 > ret_from_fork+0x1f/0x30 > > Local variable eeprom.i created at: > ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline] > ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168 > ax88179_bind+0xe75/0x1990 drivers/net/usb/ax88179_178a.c:1411 > > CPU: 1 PID: 13457 Comm: kworker/1:0 Not tainted 5.16.0-rc5-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Workqueue: usb_hub_wq hub_event > ===================================================== > > Signed-off-by: David Kahurani <k.kahurani@gmail.com> > Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com > --- > drivers/net/usb/ax88179_178a.c | 181 +++++++++++++++++++++++++++------ > 1 file changed, 152 insertions(+), 29 deletions(-) > > diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c > index a31098981..932e21a65 100644 > --- a/drivers/net/usb/ax88179_178a.c > +++ b/drivers/net/usb/ax88179_178a.c > @@ -224,9 +224,12 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, > ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, > value, index, data, size); > > - if (unlikely(ret < 0)) > + if (unlikely(ret < size)) { > + ret = ret < 0 ? ret : -ENODATA; > + > netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n", > index, ret); > + } > > return ret; > } > @@ -290,8 +293,8 @@ static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, > return ret; > } > > -static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, > - u16 size, void *data) > +static int __must_check ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, > + u16 index, u16 size, void *data) > { > int ret; > > @@ -354,8 +357,15 @@ static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc) > { > struct usbnet *dev = netdev_priv(netdev); > u16 res; > + int ret; > + > + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res); > + > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret); > + return ret; > + } > > - ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res); > return res; > } > > @@ -951,23 +961,45 @@ static int > ax88179_set_features(struct net_device *net, netdev_features_t features) > { > u8 tmp; > + int ret; > struct usbnet *dev = netdev_priv(net); > netdev_features_t changed = net->features ^ features; > > if (changed & NETIF_F_IP_CSUM) { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, > + 1, 1, &tmp); > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n", > + ret); > + return ret; > + } > + > tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP; > ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); > } > > if (changed & NETIF_F_IPV6_CSUM) { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, > + 1, 1, &tmp); > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n", > + ret); > + return ret; > + } > + > tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6; > ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); > } > > if (changed & NETIF_F_RXCSUM) { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, > + 1, 1, &tmp); > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n", > + ret); > + return ret; > + } > + > tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP | > AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6; > ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp); > @@ -980,19 +1012,36 @@ static int ax88179_change_mtu(struct net_device *net, int new_mtu) > { > struct usbnet *dev = netdev_priv(net); > u16 tmp16; > + int ret; > > net->mtu = new_mtu; > dev->hard_mtu = net->mtu + net->hard_header_len; > > if (net->mtu > 1500) { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > - 2, 2, &tmp16); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, > + AX_MEDIUM_STATUS_MODE, > + 2, 2, &tmp16); > + if (ret < 0){ > + netdev_dbg(dev->net, > + "Failed to read MEDIUM_STATUS_MODE %d\n", > + ret); > + return ret; > + } > + > tmp16 |= AX_MEDIUM_JUMBO_EN; > ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > 2, 2, &tmp16); > } else { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > - 2, 2, &tmp16); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, > + AX_MEDIUM_STATUS_MODE, > + 2, 2, &tmp16); > + if (ret < 0){ > + netdev_dbg(dev->net, > + "Failed to read MEDIUM_STATUS_MODE %d\n", > + ret); > + return ret; > + } > + > tmp16 &= ~AX_MEDIUM_JUMBO_EN; > ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > 2, 2, &tmp16); > @@ -1045,6 +1094,7 @@ static int ax88179_check_eeprom(struct usbnet *dev) > u8 i, buf, eeprom[20]; > u16 csum, delay = HZ / 10; > unsigned long jtimeout; > + int ret; > > /* Read EEPROM content */ > for (i = 0; i < 6; i++) { > @@ -1060,8 +1110,15 @@ static int ax88179_check_eeprom(struct usbnet *dev) > > jtimeout = jiffies + delay; > do { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, > - 1, 1, &buf); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, > + 1, 1, &buf); > + > + if (ret < 0) { > + netdev_dbg(dev->net, > + "Failed to read SROM_CMD: %d\n", > + ret); > + return ret; > + } > > if (time_after(jiffies, jtimeout)) > return -EINVAL; > @@ -1149,12 +1206,19 @@ static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue) > > static int ax88179_led_setting(struct usbnet *dev) > { > + int ret; > u8 ledfd, value = 0; > u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10; > unsigned long jtimeout; > > /* Check AX88179 version. UA1 or UA2*/ > - ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value); > + > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read GENERAL_STATUS: %d\n", > + ret); > + return ret; > + } > > if (!(value & AX_SECLD)) { /* UA1 */ > value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN | > @@ -1178,20 +1242,40 @@ static int ax88179_led_setting(struct usbnet *dev) > > jtimeout = jiffies + delay; > do { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, > - 1, 1, &value); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, > + 1, 1, &value); > + if (ret < 0){ > + netdev_dbg(dev->net, > + "Failed to read SROM_CMD: %d\n", > + ret); > + return ret; > + } > > if (time_after(jiffies, jtimeout)) > return -EINVAL; > > } while (value & EEP_BUSY); > > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH, > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH, > 1, 1, &value); > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read SROM_DATA_HIGH: %d\n", > + ret); > + return ret; > + } > + > + > ledvalue = (value << 8); > > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW, > - 1, 1, &value); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW, > + 1, 1, &value); > + > + if (ret < 0) { > + netdev_dbg(dev->net, "Failed to read SROM_DATA_LOW: %d", > + ret); > + return ret; > + } > + > ledvalue |= value; > > /* load internal ROM for defaule setting */ > @@ -1213,12 +1297,22 @@ static int ax88179_led_setting(struct usbnet *dev) > ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > GMII_PHYPAGE, 2, &tmp); > > - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > - GMII_LED_ACT, 2, &ledact); > + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > + GMII_LED_ACT, 2, &ledact); > + > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret); > + return ret; > + } > > - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > GMII_LED_LINK, 2, &ledlink); > > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret); > + return ret; > + } > + > ledact &= GMII_LED_ACTIVE_MASK; > ledlink &= GMII_LED_LINK_MASK; > > @@ -1295,6 +1389,7 @@ static int ax88179_led_setting(struct usbnet *dev) > static void ax88179_get_mac_addr(struct usbnet *dev) > { > u8 mac[ETH_ALEN]; > + int ret; > > memset(mac, 0, sizeof(mac)); > > @@ -1303,8 +1398,12 @@ static void ax88179_get_mac_addr(struct usbnet *dev) > netif_dbg(dev, ifup, dev->net, > "MAC address read from device tree"); > } else { > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, > ETH_ALEN, mac); > + > + if (ret < 0) > + netdev_dbg(dev->net, "Failed to read NODE_ID: %d", ret); > + > netif_dbg(dev, ifup, dev->net, > "MAC address read from ASIX chip"); > } > @@ -1572,6 +1671,7 @@ static int ax88179_link_reset(struct usbnet *dev) > u16 mode, tmp16, delay = HZ / 10; > u32 tmp32 = 0x40000000; > unsigned long jtimeout; > + int ret; > > jtimeout = jiffies + delay; > while (tmp32 & 0x40000000) { > @@ -1581,7 +1681,13 @@ static int ax88179_link_reset(struct usbnet *dev) > &ax179_data->rxctl); > > /*link up, check the usb device control TX FIFO full or empty*/ > - ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32); > + ret = ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32); > + > + if (ret < 0) { > + netdev_dbg(dev->net, "Failed to read TX FIFO: %d\n", > + ret); > + return ret; > + } > > if (time_after(jiffies, jtimeout)) > return 0; > @@ -1590,11 +1696,21 @@ static int ax88179_link_reset(struct usbnet *dev) > mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN | > AX_MEDIUM_RXFLOW_CTRLEN; > > - ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS, > - 1, 1, &link_sts); > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS, > + 1, 1, &link_sts); > + > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read LINK_STATUS: %d", ret); > + return ret; > + } > > - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > - GMII_PHY_PHYSR, 2, &tmp16); > + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, > + GMII_PHY_PHYSR, 2, &tmp16); > + > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret); > + return ret; > + } > > if (!(tmp16 & GMII_PHY_PHYSR_LINK)) { > return 0; > @@ -1732,9 +1848,16 @@ static int ax88179_reset(struct usbnet *dev) > static int ax88179_stop(struct usbnet *dev) > { > u16 tmp16; > + int ret; > > - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > 2, 2, &tmp16); > + > + if (ret < 0){ > + netdev_dbg(dev->net, "Failed to read STATUS_MODE: %d\n", ret); > + return ret; > + } > + > tmp16 &= ~AX_MEDIUM_RECEIVE_EN; > ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, > 2, 2, &tmp16); > -- > 2.25.1 ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting 2022-03-26 11:47 ` David Kahurani @ 2022-03-26 12:10 ` Pavel Skripkin 2022-03-26 12:43 ` Pavel Skripkin 1 sibling, 0 replies; 9+ messages in thread From: Pavel Skripkin @ 2022-03-26 12:10 UTC (permalink / raw) To: David Kahurani, davem, jgg, kuba, linux-kernel, linux-usb, netdev, phil, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd Hi David, On 3/26/22 14:47, David Kahurani wrote: > Same here. My apologies. > > On Sat, Mar 26, 2022 at 2:28 PM David Kahurani <k.kahurani@gmail.com> wrote: >> >> Hello, >> >> syzbot found the following issue on: >> >> HEAD commit: 85cfd6e539bd kmsan: core: delete kmsan_gup_pgd_range() >> git tree: https://github.com/google/kmsan.git master >> console output: https://syzkaller.appspot.com/x/log.txt?x=12d6c53c700000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=b9807dd5b044fd7a >> dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 >> compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 >> >> Based off a previous patch to fix a similar issue. >> ------------------------- Looks sane. Can you, please, send it as proper patch with explanation in commit message and with a bit cutted log, since full ->probe() calltrace is not interesting :) With regards, Pavel Skripkin ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting 2022-03-26 11:47 ` David Kahurani 2022-03-26 12:10 ` Pavel Skripkin @ 2022-03-26 12:43 ` Pavel Skripkin 2022-03-26 18:26 ` David Kahurani 1 sibling, 1 reply; 9+ messages in thread From: Pavel Skripkin @ 2022-03-26 12:43 UTC (permalink / raw) To: David Kahurani, davem, jgg, kuba, linux-kernel, linux-usb, netdev, phil, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd Hi David, On 3/26/22 14:47, David Kahurani wrote: >> >> Signed-off-by: David Kahurani <k.kahurani@gmail.com> >> Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com >> --- >> drivers/net/usb/ax88179_178a.c | 181 +++++++++++++++++++++++++++------ >> 1 file changed, 152 insertions(+), 29 deletions(-) >> >> diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c >> index a31098981..932e21a65 100644 >> --- a/drivers/net/usb/ax88179_178a.c >> +++ b/drivers/net/usb/ax88179_178a.c >> @@ -224,9 +224,12 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, >> ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, >> value, index, data, size); >> You've changed __ax88179_write_cmd(), but not __ax88179_read_cmd(). I've missed it. Changing __ax88179_write_cmd() does not help with uninit value bugs Also I believe, __ax88179_read_cmd() should have __must_check annotation too, since problem came from it in the first place (I mean after added sane error handling inside it) Next thing is ax88179_read_cmd_nopm() still prone to uninit value bugs, since it touches uninitialized `buf` in case of __ax88179_read_cmd() error... I remembered why I gave up on fixing this driver... I hope, you have more free time and motivation :) With regards, Pavel Skripkin ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting 2022-03-26 12:43 ` Pavel Skripkin @ 2022-03-26 18:26 ` David Kahurani 0 siblings, 0 replies; 9+ messages in thread From: David Kahurani @ 2022-03-26 18:26 UTC (permalink / raw) To: Pavel Skripkin Cc: davem, jgg, kuba, linux-kernel, linux-usb, netdev, Phillip Potter, syzkaller-bugs, syzbot+d3dbdf31fbe9d8f5f311, arnd On Sat, Mar 26, 2022 at 3:43 PM Pavel Skripkin <paskripkin@gmail.com> wrote: > > Hi David, > > On 3/26/22 14:47, David Kahurani wrote: > >> > >> Signed-off-by: David Kahurani <k.kahurani@gmail.com> > >> Reported-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com > >> --- > >> drivers/net/usb/ax88179_178a.c | 181 +++++++++++++++++++++++++++------ > >> 1 file changed, 152 insertions(+), 29 deletions(-) > >> > >> diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c > >> index a31098981..932e21a65 100644 > >> --- a/drivers/net/usb/ax88179_178a.c > >> +++ b/drivers/net/usb/ax88179_178a.c > >> @@ -224,9 +224,12 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, > >> ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, > >> value, index, data, size); > >> > Yes, this breaks the logic of the entire patch. It was a mistake. Will fix that alongside your other comments. > You've changed __ax88179_write_cmd(), but not __ax88179_read_cmd(). I've > missed it. Changing __ax88179_write_cmd() does not help with uninit > value bugs > > Also I believe, __ax88179_read_cmd() should have __must_check annotation > too, since problem came from it in the first place (I mean after added > sane error handling inside it) > > Next thing is ax88179_read_cmd_nopm() still prone to uninit value bugs, > since it touches uninitialized `buf` in case of __ax88179_read_cmd() > error... > > > > I remembered why I gave up on fixing this driver... I hope, you have > more free time and motivation :) > > > > > With regards, > Pavel Skripkin ^ permalink raw reply [flat|nested] 9+ messages in thread
[parent not found: <CAAZOf24aXhyYd1pv0J63+2oLJ7K=yFFTXm_sE022-spCMMz6QQ@mail.gmail.com>]
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting [not found] <CAAZOf24aXhyYd1pv0J63+2oLJ7K=yFFTXm_sE022-spCMMz6QQ@mail.gmail.com> @ 2022-04-09 8:40 ` syzbot 2022-04-15 1:54 ` David Kahurani 0 siblings, 1 reply; 9+ messages in thread From: syzbot @ 2022-04-09 8:40 UTC (permalink / raw) To: arnd, dan.carpenter, davem, glider, jackychou, jannh, jgg, k.kahurani, kbuild-all, kuba, linux-kernel, linux-usb, lkp, netdev, pabeni, paskripkin, phil, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com Tested on: commit: 33d9269e Revert "kernel: kmsan: don't instrument stack.. git tree: https://github.com/google/kmsan.git master kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873 dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 patch: https://syzkaller.appspot.com/x/patch.diff?x=1130ceb7700000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting 2022-04-09 8:40 ` syzbot @ 2022-04-15 1:54 ` David Kahurani 2022-04-15 3:53 ` syzbot 0 siblings, 1 reply; 9+ messages in thread From: David Kahurani @ 2022-04-15 1:54 UTC (permalink / raw) To: syzbot Cc: arnd, Dan Carpenter, davem, Alexander Potapenko, jackychou, Jann Horn, jgg, kbuild-all, kuba, linux-kernel, linux-usb, lkp, netdev, pabeni, Pavel Skripkin, Phillip Potter, syzkaller-bugs [-- Attachment #1: Type: text/plain, Size: 1007 bytes --] Made some changes, got to test this again just to be sure. #syz test https://github.com/google/kmsan.git master On Sat, Apr 9, 2022 at 11:40 AM syzbot <syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com> wrote: > > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com > > Tested on: > > commit: 33d9269e Revert "kernel: kmsan: don't instrument stack.. > git tree: https://github.com/google/kmsan.git master > kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873 > dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 > compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 > patch: https://syzkaller.appspot.com/x/patch.diff?x=1130ceb7700000 > > Note: testing is done by a robot and is best-effort only. [-- Attachment #2: 0001-net-ax88179-add-proper-error-handling-of-usb-read-er.patch --] [-- Type: text/x-patch, Size: 17762 bytes --] From 52430ebdbce0192019e1b354fb5cba487ebcfb09 Mon Sep 17 00:00:00 2001 From: David Kahurani <k.kahurani@gmail.com> Date: Thu, 14 Apr 2022 15:16:02 +0300 Subject: [PATCH] net: ax88179: add proper error handling of usb read errors Reads that are lesser than the requested size lead to uninit-value bugs. An example of such a bug can be seen below whereby a local variable into which the contents of reads were supposed to be stored is left uninitialized after a partial read. Qualify such reads as errors and handle them correctly. Local variable eeprom.i created at: ax88179_check_eeprom drivers/net/usb/ax88179_178a.c:1045 [inline] ax88179_led_setting+0x2e2/0x30b0 drivers/net/usb/ax88179_178a.c:1168 ax88179_bind+0xf00/0x1a50 drivers/net/usb/ax88179_178a.c:1412 Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") Signed-off-by: David Kahurani <k.kahurani@gmail.com> Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com --- drivers/net/usb/ax88179_178a.c | 279 ++++++++++++++++++++++++++------- 1 file changed, 226 insertions(+), 53 deletions(-) diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c index e2fa56b92..5113ed63f 100644 --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -185,8 +185,9 @@ static const struct { {7, 0xcc, 0x4c, 0x18, 8}, }; -static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, - u16 size, void *data, int in_pm) +static int __must_check __ax88179_read_cmd(struct usbnet *dev, u8 cmd, + u16 value, u16 index, u16 size, + void *data, int in_pm) { int ret; int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16); @@ -201,11 +202,15 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, value, index, data, size); - if (unlikely(ret < 0)) + if (unlikely(ret < size)) { + ret = ret < 0 ? ret : -ENODATA; + netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n", index, ret); + return ret; + } - return ret; + return 0; } static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, @@ -249,26 +254,33 @@ static void ax88179_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value, } } -static int ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, - u16 index, u16 size, void *data) +static int __must_check ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd, + u16 value, u16 index, u16 size, + void *data) { int ret; if (2 == size) { u16 buf; ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1); + if (ret) + return ret; le16_to_cpus(&buf); *((u16 *)data) = buf; } else if (4 == size) { u32 buf; ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1); + if (ret) + return ret; le32_to_cpus(&buf); *((u32 *)data) = buf; } else { ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 1); + if (ret) + return ret; } - return ret; + return 0; } static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, @@ -290,26 +302,32 @@ static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value, return ret; } -static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, - u16 size, void *data) +static int __must_check ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, + u16 index, u16 size, void *data) { int ret; if (2 == size) { u16 buf = 0; ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0); + if (ret) + return ret; le16_to_cpus(&buf); *((u16 *)data) = buf; } else if (4 == size) { u32 buf = 0; ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0); + if (ret) + return ret; le32_to_cpus(&buf); *((u32 *)data) = buf; } else { ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 0); + if (ret) + return ret; } - return ret; + return 0; } static int ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, @@ -354,8 +372,15 @@ static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc) { struct usbnet *dev = netdev_priv(netdev); u16 res; + int ret; + + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res); + + if (ret) { + netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret); + return ret; + } - ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res); return res; } @@ -416,7 +441,7 @@ ax88179_phy_write_mmd_indirect(struct usbnet *dev, u16 prtad, u16 devad, ret = ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, MII_MMD_DATA, 2, &data); - if (ret < 0) + if (ret) return ret; return 0; @@ -427,19 +452,31 @@ static int ax88179_suspend(struct usb_interface *intf, pm_message_t message) struct usbnet *dev = usb_get_intfdata(intf); u16 tmp16; u8 tmp8; + int ret; usbnet_suspend(intf, message); /* Disable RX path */ - ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, - 2, 2, &tmp16); + ret = ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, + 2, 2, &tmp16); + + if (ret) { + netdev_dbg(dev->net, "Failed to read MEDIUM_STATUS_MODE: %d\n", + ret); + return ret; + } + tmp16 &= ~AX_MEDIUM_RECEIVE_EN; ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, 2, 2, &tmp16); /* Force bulk-in zero length */ - ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, - 2, 2, &tmp16); + ret = ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, + 2, 2, &tmp16); + if (ret) { + netdev_dbg(dev->net, "Failed to read PHYPWR_RSTCTL: %d\n", ret); + return ret; + } tmp16 |= AX_PHYPWR_RSTCTL_BZ | AX_PHYPWR_RSTCTL_IPRL; ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, @@ -462,6 +499,7 @@ static int ax88179_auto_detach(struct usbnet *dev, int in_pm) { u16 tmp16; u8 tmp8; + int ret; int (*fnr)(struct usbnet *, u8, u16, u16, u16, void *); int (*fnw)(struct usbnet *, u8, u16, u16, u16, const void *); @@ -481,11 +519,19 @@ static int ax88179_auto_detach(struct usbnet *dev, int in_pm) /* Enable Auto Detach bit */ tmp8 = 0; - fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8); + ret = fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8); + if (ret) { + netdev_dbg(dev->net, "Failed to read CLK_SELECT: %d", ret); + return ret; + } tmp8 |= AX_CLK_SELECT_ULR; fnw(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8); - fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16); + ret = fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16); + if (ret) { + netdev_dbg(dev->net, "Failed to read PHYPWR_RSTCTL: %d", ret); + return ret; + } tmp16 |= AX_PHYPWR_RSTCTL_AT; fnw(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16); @@ -497,6 +543,7 @@ static int ax88179_resume(struct usb_interface *intf) struct usbnet *dev = usb_get_intfdata(intf); u16 tmp16; u8 tmp8; + int ret; usbnet_link_change(dev, 0, 0); @@ -515,7 +562,14 @@ static int ax88179_resume(struct usb_interface *intf) ax88179_auto_detach(dev, 1); /* Enable clock */ - ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8); + ret = ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8); + + if (ret) { + netdev_dbg(dev->net, "Failed to read CLK_SELECT %d\n", ret); + + return ret; + } + tmp8 |= AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS; ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8); msleep(100); @@ -601,7 +655,7 @@ ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom, ret = __ax88179_read_cmd(dev, AX_ACCESS_EEPROM, i, 1, 2, &eeprom_buff[i - first_word], 0); - if (ret < 0) { + if (ret) { kfree(eeprom_buff); return -EIO; } @@ -645,7 +699,7 @@ ax88179_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom, if (eeprom->offset & 1) { ret = ax88179_read_cmd(dev, AX_ACCESS_EEPROM, first_word, 1, 2, &eeprom_buff[0]); - if (ret < 0) { + if (ret) { netdev_err(net, "Failed to read EEPROM at offset 0x%02x.\n", first_word); goto free; } @@ -654,7 +708,7 @@ ax88179_set_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom, if ((eeprom->offset + eeprom->len) & 1) { ret = ax88179_read_cmd(dev, AX_ACCESS_EEPROM, last_word, 1, 2, &eeprom_buff[last_word - first_word]); - if (ret < 0) { + if (ret) { netdev_err(net, "Failed to read EEPROM at offset 0x%02x.\n", last_word); goto free; } @@ -951,23 +1005,45 @@ static int ax88179_set_features(struct net_device *net, netdev_features_t features) { u8 tmp; + int ret; struct usbnet *dev = netdev_priv(net); netdev_features_t changed = net->features ^ features; if (changed & NETIF_F_IP_CSUM) { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, + 1, 1, &tmp); + if (ret) { + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n", + ret); + return ret; + } + tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP; ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); } if (changed & NETIF_F_IPV6_CSUM) { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, + 1, 1, &tmp); + if (ret) { + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n", + ret); + return ret; + } + tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6; ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp); } if (changed & NETIF_F_RXCSUM) { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, + 1, 1, &tmp); + if (ret) { + netdev_dbg(dev->net, "Failed to read TXCOE_CTL: %d\n", + ret); + return ret; + } + tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP | AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6; ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp); @@ -980,19 +1056,36 @@ static int ax88179_change_mtu(struct net_device *net, int new_mtu) { struct usbnet *dev = netdev_priv(net); u16 tmp16; + int ret; net->mtu = new_mtu; dev->hard_mtu = net->mtu + net->hard_header_len; if (net->mtu > 1500) { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, - 2, 2, &tmp16); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, + AX_MEDIUM_STATUS_MODE, + 2, 2, &tmp16); + if (ret) { + netdev_dbg(dev->net, + "Failed to read MEDIUM_STATUS_MODE %d\n", + ret); + return ret; + } + tmp16 |= AX_MEDIUM_JUMBO_EN; ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, 2, 2, &tmp16); } else { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, - 2, 2, &tmp16); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, + AX_MEDIUM_STATUS_MODE, + 2, 2, &tmp16); + if (ret) { + netdev_dbg(dev->net, + "Failed to read MEDIUM_STATUS_MODE %d\n", + ret); + return ret; + } + tmp16 &= ~AX_MEDIUM_JUMBO_EN; ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, 2, 2, &tmp16); @@ -1045,6 +1138,7 @@ static int ax88179_check_eeprom(struct usbnet *dev) u8 i, buf, eeprom[20]; u16 csum, delay = HZ / 10; unsigned long jtimeout; + int ret; /* Read EEPROM content */ for (i = 0; i < 6; i++) { @@ -1060,16 +1154,29 @@ static int ax88179_check_eeprom(struct usbnet *dev) jtimeout = jiffies + delay; do { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, - 1, 1, &buf); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, + 1, 1, &buf); + if (ret) { + netdev_dbg(dev->net, + "Failed to read SROM_CMD: %d\n", + ret); + return ret; + } if (time_after(jiffies, jtimeout)) return -EINVAL; } while (buf & EEP_BUSY); - __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW, - 2, 2, &eeprom[i * 2], 0); + ret = __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW, + 2, 2, &eeprom[i * 2], 0); + + if (ret) { + netdev_dbg(dev->net, + "Failed to read SROM_DATA_LOW: %d\n", + ret); + return ret; + } if ((i == 0) && (eeprom[0] == 0xFF)) return -EINVAL; @@ -1149,12 +1256,20 @@ static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue) static int ax88179_led_setting(struct usbnet *dev) { + int ret; u8 ledfd, value = 0; u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10; unsigned long jtimeout; /* Check AX88179 version. UA1 or UA2*/ - ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, + &value); + + if (ret) { + netdev_dbg(dev->net, "Failed to read GENERAL_STATUS: %d\n", + ret); + return ret; + } if (!(value & AX_SECLD)) { /* UA1 */ value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN | @@ -1178,20 +1293,39 @@ static int ax88179_led_setting(struct usbnet *dev) jtimeout = jiffies + delay; do { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, - 1, 1, &value); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD, + 1, 1, &value); + if (ret) { + netdev_dbg(dev->net, + "Failed to read SROM_CMD: %d\n", + ret); + return ret; + } if (time_after(jiffies, jtimeout)) return -EINVAL; } while (value & EEP_BUSY); - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH, - 1, 1, &value); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH, + 1, 1, &value); + if (ret) { + netdev_dbg(dev->net, "Failed to read SROM_DATA_HIGH: %d\n", + ret); + return ret; + } + ledvalue = (value << 8); - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW, - 1, 1, &value); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW, + 1, 1, &value); + + if (ret) { + netdev_dbg(dev->net, "Failed to read SROM_DATA_LOW: %d", + ret); + return ret; + } + ledvalue |= value; /* load internal ROM for defaule setting */ @@ -1213,11 +1347,21 @@ static int ax88179_led_setting(struct usbnet *dev) ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, GMII_PHYPAGE, 2, &tmp); - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, - GMII_LED_ACT, 2, &ledact); + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, + GMII_LED_ACT, 2, &ledact); - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, - GMII_LED_LINK, 2, &ledlink); + if (ret) { + netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret); + return ret; + } + + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, + GMII_LED_LINK, 2, &ledlink); + + if (ret) { + netdev_dbg(dev->net, "Failed to read PHY_ID: %d", ret); + return ret; + } ledact &= GMII_LED_ACTIVE_MASK; ledlink &= GMII_LED_LINK_MASK; @@ -1295,6 +1439,7 @@ static int ax88179_led_setting(struct usbnet *dev) static void ax88179_get_mac_addr(struct usbnet *dev) { u8 mac[ETH_ALEN]; + int ret; memset(mac, 0, sizeof(mac)); @@ -1303,8 +1448,12 @@ static void ax88179_get_mac_addr(struct usbnet *dev) netif_dbg(dev, ifup, dev->net, "MAC address read from device tree"); } else { - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, - ETH_ALEN, mac); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, + ETH_ALEN, mac); + + if (ret) + netdev_dbg(dev->net, "Failed to read NODE_ID: %d", ret); + netif_dbg(dev, ifup, dev->net, "MAC address read from ASIX chip"); } @@ -1572,6 +1721,7 @@ static int ax88179_link_reset(struct usbnet *dev) u16 mode, tmp16, delay = HZ / 10; u32 tmp32 = 0x40000000; unsigned long jtimeout; + int ret; jtimeout = jiffies + delay; while (tmp32 & 0x40000000) { @@ -1581,7 +1731,13 @@ static int ax88179_link_reset(struct usbnet *dev) &ax179_data->rxctl); /*link up, check the usb device control TX FIFO full or empty*/ - ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32); + ret = ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32); + + if (ret) { + netdev_dbg(dev->net, "Failed to read TX FIFO: %d\n", + ret); + return ret; + } if (time_after(jiffies, jtimeout)) return 0; @@ -1590,11 +1746,21 @@ static int ax88179_link_reset(struct usbnet *dev) mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN | AX_MEDIUM_RXFLOW_CTRLEN; - ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS, - 1, 1, &link_sts); + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS, + 1, 1, &link_sts); + + if (ret) { + netdev_dbg(dev->net, "Failed to read LINK_STATUS: %d", ret); + return ret; + } + + ret = ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, + GMII_PHY_PHYSR, 2, &tmp16); - ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID, - GMII_PHY_PHYSR, 2, &tmp16); + if (ret) { + netdev_dbg(dev->net, "Failed to read PHY_ID: %d\n", ret); + return ret; + } if (!(tmp16 & GMII_PHY_PHYSR_LINK)) { return 0; @@ -1732,9 +1898,16 @@ static int ax88179_reset(struct usbnet *dev) static int ax88179_stop(struct usbnet *dev) { u16 tmp16; + int ret; + + ret = ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, + 2, 2, &tmp16); + + if (ret) { + netdev_dbg(dev->net, "Failed to read STATUS_MODE: %d\n", ret); + return ret; + } - ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, - 2, 2, &tmp16); tmp16 &= ~AX_MEDIUM_RECEIVE_EN; ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE, 2, 2, &tmp16); -- 2.25.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [syzbot] KMSAN: uninit-value in ax88179_led_setting 2022-04-15 1:54 ` David Kahurani @ 2022-04-15 3:53 ` syzbot 0 siblings, 0 replies; 9+ messages in thread From: syzbot @ 2022-04-15 3:53 UTC (permalink / raw) To: arnd, dan.carpenter, davem, glider, jackychou, jannh, jgg, k.kahurani, kbuild-all, kuba, linux-kernel, linux-usb, lkp, netdev, pabeni, paskripkin, phil, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+d3dbdf31fbe9d8f5f311@syzkaller.appspotmail.com Tested on: commit: 33d9269e Revert "kernel: kmsan: don't instrument stack.. git tree: https://github.com/google/kmsan.git master kernel config: https://syzkaller.appspot.com/x/.config?x=d830111cc3be873 dashboard link: https://syzkaller.appspot.com/bug?extid=d3dbdf31fbe9d8f5f311 compiler: clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2 patch: https://syzkaller.appspot.com/x/patch.diff?x=151cb868f00000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2022-04-15 3:53 UTC | newest] Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-02-15 10:42 [syzbot] KMSAN: uninit-value in ax88179_led_setting syzbot 2022-04-07 2:41 ` syzbot [not found] <CAAZOf27PHWxdZifZpQYfTHb3h=qk22jRc6-A2LvBkLTR6xNOKg@mail.gmail.com> 2022-03-26 11:47 ` David Kahurani 2022-03-26 12:10 ` Pavel Skripkin 2022-03-26 12:43 ` Pavel Skripkin 2022-03-26 18:26 ` David Kahurani [not found] <CAAZOf24aXhyYd1pv0J63+2oLJ7K=yFFTXm_sE022-spCMMz6QQ@mail.gmail.com> 2022-04-09 8:40 ` syzbot 2022-04-15 1:54 ` David Kahurani 2022-04-15 3:53 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).