linux-kernel - Re: [PATCH] [media] dib0700: Fix uninitialized protocol for NEC repeat codes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2016 22:14:07 +0100
From:   Sean Young <sean@...s.org>
To:     Geert Uytterhoeven <geert@...ux-m68k.org>
Cc:     Mauro Carvalho Chehab <mchehab@...pensource.com>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] [media] dib0700: Fix uninitialized protocol for NEC
 repeat codes

On Thu, Oct 13, 2016 at 03:51:39PM +0200, Geert Uytterhoeven wrote:
>     drivers/media/usb/dvb-usb/dib0700_core.c: In function ‘dib0700_rc_urb_completion’:
>     drivers/media/usb/dvb-usb/dib0700_core.c:679: warning: ‘protocol’ may be used uninitialized in this function
> 
> When receiving an NEC repeat code, protocol is indeed not initialized.
> Set it to RC_TYPE_NECX to fix this.
> 
> Fixes: 2ceeca0499d74521 ("[media] rc: split nec protocol into its three variants")
> Signed-off-by: Geert Uytterhoeven <geert@...ux-m68k.org>
> ---
> Is RC_TYPE_NECX correct, or should it be RC_TYPE_NEC?
> I used RC_TYPE_NECX based on the checks for {,not_}data and
> {,not_}system for the other cases.

It should be the protocol that the last scancode was received with. This
code path is very broken; it calls:

	rc_keydown(d->rc_dev, protocol, keycode, toggle);

But keycode in this codepath is never set. Luckily keycode is declared as:

	u32 uninitialized_var(keycode);

I've got another patch for this which I'll send as a reply to this.


Sean


> ---
>  drivers/media/usb/dvb-usb/dib0700_core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
> index f3196658fb700706..5878ae4d20ad27ed 100644
> --- a/drivers/media/usb/dvb-usb/dib0700_core.c
> +++ b/drivers/media/usb/dvb-usb/dib0700_core.c
> @@ -718,6 +718,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
>  		    poll_reply->nec.data       == 0x00 &&
>  		    poll_reply->nec.not_data   == 0xff) {
>  			poll_reply->data_state = 2;
> +			protocol = RC_TYPE_NECX;
>  			break;
>  		}
>  
> -- 
> 1.9.1
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html