From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
To: syzbot+e7d46eb426883fb97efd@syzkaller.appspotmail.com
Cc: glider@google.com, gregkh@linuxfoundation.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com,
usb-storage@lists.one-eyed-alien.net,
Kernel Janitors <kernel-janitors@vger.kernel.org>
Subject: Re: KMSAN: uninit-value in alauda_check_media
Date: Tue, 28 Dec 2021 08:47:15 +0100 [thread overview]
Message-ID: <f78b974a-e36b-6d23-6977-fdf50c05600b@wanadoo.fr> (raw)
In-Reply-To: <0000000000007d25ff059457342d@google.com>
[-- Attachment #1: Type: text/plain, Size: 515 bytes --]
Hi,
(2nd try - text only format - sorry for the noise)
first try to use syzbot. I hope I do it right.
Discussion about the syz report can be found at
https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/
This patch only test if alauda_get_media_status() (and its embedded
usb_stor_ctrl_transfer()) before using the data.
In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
CJ
[-- Attachment #2: patch_alauda.c --]
[-- Type: text/x-csrc, Size: 983 bytes --]
diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 20b857e97e60..6c486d964911 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -318,7 +318,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
command, 0xc0, 0, 1, data, 2);
- usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
+ if (rc == USB_STOR_XFER_GOOD)
+ usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
return rc;
}
@@ -453,8 +454,11 @@ static int alauda_check_media(struct us_data *us)
{
struct alauda_info *info = (struct alauda_info *) us->extra;
unsigned char status[2];
+ int rc;
- alauda_get_media_status(us, status);
+ rc = alauda_get_media_status(us, status);
+ if (rc != USB_STOR_TRANSPORT_GOOD)
+ return USB_STOR_TRANSPORT_ERROR;
/* Check for no media or door open */
if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
next prev parent reply other threads:[~2021-12-28 7:47 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-07 19:39 KMSAN: uninit-value in alauda_check_media syzbot
2019-10-11 11:23 ` Jaskaran Singh
2019-10-11 11:51 ` Alexander Potapenko
2019-10-11 15:42 ` syzbot
2019-10-11 14:08 ` Alan Stern
2019-10-11 14:18 ` Andrey Konovalov
2019-10-11 14:53 ` Alan Stern
2019-10-11 15:06 ` Greg Kroah-Hartman
2019-10-14 12:56 ` Andrey Konovalov
2019-10-11 15:24 ` syzbot
2021-12-28 7:47 ` Christophe JAILLET [this message]
2021-12-28 7:47 ` syzbot
2021-12-28 22:49 ` Alan Stern
2021-12-29 9:16 ` Christophe JAILLET
2021-12-29 16:45 ` Alan Stern
2021-12-28 8:01 ` Christophe JAILLET
2021-12-28 11:10 ` [syzbot] " syzbot
2019-10-11 11:17 Jas K
[not found] <cca3b7b4-d9cf-a275-ec0a-c99720a94049@wanadoo.fr>
2021-12-28 7:52 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f78b974a-e36b-6d23-6977-fdf50c05600b@wanadoo.fr \
--to=christophe.jaillet@wanadoo.fr \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+e7d46eb426883fb97efd@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=usb-storage@lists.one-eyed-alien.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).