From: Alan Stern <stern@rowland.harvard.edu>
To: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: syzbot+e7d46eb426883fb97efd@syzkaller.appspotmail.com,
glider@google.com, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
syzkaller-bugs@googlegroups.com,
usb-storage@lists.one-eyed-alien.net,
Kernel Janitors <kernel-janitors@vger.kernel.org>
Subject: Re: KMSAN: uninit-value in alauda_check_media
Date: Tue, 28 Dec 2021 17:49:03 -0500 [thread overview]
Message-ID: <YcuUX6BVo+HA1TcI@rowland.harvard.edu> (raw)
In-Reply-To: <f78b974a-e36b-6d23-6977-fdf50c05600b@wanadoo.fr>
On Tue, Dec 28, 2021 at 08:47:15AM +0100, Christophe JAILLET wrote:
> Hi,
>
> (2nd try - text only format - sorry for the noise)
>
>
> first try to use syzbot. I hope I do it right.
> Discussion about the syz report can be found at
> https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/
>
> This patch only test if alauda_get_media_status() (and its embedded
> usb_stor_ctrl_transfer()) before using the data.
> In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> master
>
> CJ
>
> diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
> index 20b857e97e60..6c486d964911 100644
> --- a/drivers/usb/storage/alauda.c
> +++ b/drivers/usb/storage/alauda.c
> @@ -318,7 +318,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
> rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
> command, 0xc0, 0, 1, data, 2);
>
> - usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
> + if (rc == USB_STOR_XFER_GOOD)
> + usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
Instead of adding this test, you could initialize data[0] and data[1]
to zero before the call to usb_stor_ctrl_transfer.
>
> return rc;
> }
> @@ -453,8 +454,11 @@ static int alauda_check_media(struct us_data *us)
> {
> struct alauda_info *info = (struct alauda_info *) us->extra;
> unsigned char status[2];
> + int rc;
>
> - alauda_get_media_status(us, status);
> + rc = alauda_get_media_status(us, status);
> + if (rc != USB_STOR_TRANSPORT_GOOD)
> + return USB_STOR_TRANSPORT_ERROR;
>
> /* Check for no media or door open */
> if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
In general this looks fine. Let us know when you are ready to submit
the patch.
Alan Stern
next prev parent reply other threads:[~2021-12-28 22:49 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-07 19:39 KMSAN: uninit-value in alauda_check_media syzbot
2019-10-11 11:23 ` Jaskaran Singh
2019-10-11 11:51 ` Alexander Potapenko
2019-10-11 15:42 ` syzbot
2019-10-11 14:08 ` Alan Stern
2019-10-11 14:18 ` Andrey Konovalov
2019-10-11 14:53 ` Alan Stern
2019-10-11 15:06 ` Greg Kroah-Hartman
2019-10-14 12:56 ` Andrey Konovalov
2019-10-11 15:24 ` syzbot
2021-12-28 7:47 ` Christophe JAILLET
2021-12-28 7:47 ` syzbot
2021-12-28 22:49 ` Alan Stern [this message]
2021-12-29 9:16 ` Christophe JAILLET
2021-12-29 16:45 ` Alan Stern
2021-12-28 8:01 ` Christophe JAILLET
2021-12-28 11:10 ` [syzbot] " syzbot
2019-10-11 11:17 Jas K
[not found] <cca3b7b4-d9cf-a275-ec0a-c99720a94049@wanadoo.fr>
2021-12-28 7:52 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YcuUX6BVo+HA1TcI@rowland.harvard.edu \
--to=stern@rowland.harvard.edu \
--cc=christophe.jaillet@wanadoo.fr \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=syzbot+e7d46eb426883fb97efd@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=usb-storage@lists.one-eyed-alien.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).