linux-kernel - Re: [PATCH] media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2417bf98-424b-4d37-ae36-8f5affaffb24@fintech.ru>
Date: Mon, 26 Aug 2024 03:39:35 -0700
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Mauro Carvalho Chehab <mchehab@...nel.org>, Hans Verkuil
	<hverkuil-cisco@...all.nl>
CC: Luis Chamberlain <mcgrof@...nel.org>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>, Patrick Boettcher <pb@...uxtv.org>,
	<linux-media@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<syzbot+c88fc0ebe0d5935c70da@...kaller.appspotmail.com>,
	<n.zhandarovich@...tech.ru>
Subject: Re: [PATCH] media: dvb-frontends: dib3000mb: fix uninit-value in
 dib3000_write_reg

Hi,

On 5/17/24 08:58, Nikita Zhandarovich wrote:
> Syzbot reports [1] an uninitialized value issue found by KMSAN in
> dib3000_read_reg().
> 
> Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case
> that call fails, the buffer may end up with some undefined values.
> 
> Since no elaborate error handling is expected in dib3000_write_reg(),
> simply zero out rb buffer to mitigate the problem.
> 
> [1] Syzkaller report
> dvb-usb: bulk message failed: -22 (6/0)
> =====================================================
> BUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758
>  dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758
>  dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31
>  dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290
>  dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline]
>  dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline]
>  dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310
>  dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110
> ...
> Local variable rb created at:
>  dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54
>  dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758
> ...
> 
> Fixes: 74340b0a8bc6 ("V4L/DVB (4457): Remove dib3000-common-module")
> Reported-by: syzbot+c88fc0ebe0d5935c70da@...kaller.appspotmail.com
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
> ---
>  drivers/media/dvb-frontends/dib3000mb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/dvb-frontends/dib3000mb.c b/drivers/media/dvb-frontends/dib3000mb.c
> index c598b2a63325..7c452ddd9e40 100644
> --- a/drivers/media/dvb-frontends/dib3000mb.c
> +++ b/drivers/media/dvb-frontends/dib3000mb.c
> @@ -51,7 +51,7 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,2=xfer,4=setfe,8=getfe (|-a
>  static int dib3000_read_reg(struct dib3000_state *state, u16 reg)
>  {
>  	u8 wb[] = { ((reg >> 8) | 0x80) & 0xff, reg & 0xff };
> -	u8 rb[2];
> +	u8 rb[2] = {};
>  	struct i2c_msg msg[] = {
>  		{ .addr = state->config.demod_address, .flags = 0,        .buf = wb, .len = 2 },
>  		{ .addr = state->config.demod_address, .flags = I2C_M_RD, .buf = rb, .len = 2 },


Gentle ping...

Regards,
Nikita