[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <tencent_08AE7451777167B63C51364097F8363A4A09@qq.com>
Date: Fri, 6 Sep 2024 21:52:09 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+9d34f80f841e948c3fdb@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] KMSAN: kernel-usb-infoleak in usbtmc_write
Clear the buffer that has not been set, after copying data from user space.
#syz test
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 6bd9fe565385..faf8c5508997 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1591,6 +1591,10 @@ static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
goto exit;
}
+ if (transfersize % 4)
+ memset(&buffer[USBTMC_HEADER_SIZE + transfersize], 0,
+ aligned - USBTMC_HEADER_SIZE - transfersize);
+
dev_dbg(&data->intf->dev, "%s(size:%u align:%u)\n", __func__,
(unsigned int)transfersize, (unsigned int)aligned);
Powered by blists - more mailing lists