linux-kernel - Re: [PATCH] usb: cdnsp: Fixes error: uninitialized symbol 'len'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ddba44b4-5c5c-0085-2678-9f8151811494@suse.com>
Date:   Wed, 5 Apr 2023 19:41:53 +0200
From:   Oliver Neukum <oneukum@...e.com>
To:     Greg KH <gregkh@...uxfoundation.org>,
        Pawel Laszczak <pawell@...ence.com>
Cc:     peter.chen@...nel.org, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] usb: cdnsp: Fixes error: uninitialized symbol 'len'

On 05.04.23 19:23, Greg KH wrote:
> On Fri, Mar 31, 2023 at 05:06:00AM -0400, Pawel Laszczak wrote:

>>   {
>>   	struct usb_ctrlrequest *ctrl = &pdev->setup;
>> -	int ret = 0;
>> +	int ret = -EINVAL;
>>   	u16 len;
>>   
>>   	trace_cdnsp_ctrl_req(ctrl);
>> @@ -424,7 +424,6 @@ void cdnsp_setup_analyze(struct cdnsp_device *pdev)
>>   
>>   	if (pdev->gadget.state == USB_STATE_NOTATTACHED) {
>>   		dev_err(pdev->dev, "ERR: Setup detected in unattached state\n");
>> -		ret = -EINVAL;
> 
> That's a nice change, but I don't see the original error here that you
> are saying this change fixes.
> 
> What am I missing?

The function has this check at its beginning:

        if (!pdev->gadget_driver)
                 goto out;

ret is initialized to 0 and len is uninitialized.
The jump goes to:

out:
         if (ret < 0)
                 cdnsp_ep0_stall(pdev);
         else if (!len && pdev->ep0_stage != CDNSP_STATUS_STAGE)
                 cdnsp_status_stage(pdev);


The compiler (and an analysis tool) can determine that len will be
evaluated in an uninitialized state. Setting ret to something
negative prevents that. I must say this is convoluted, even though
it is correct.

	HTH
		Oliver