netdev - Re: [syzbot] KMSAN: uninit-value in asix_mdio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yb5Vu8+45wh5FiCQ@lunn.ch>
Date:   Sat, 18 Dec 2021 22:42:19 +0100
From:   Andrew Lunn <andrew@...n.ch>
To:     Pavel Skripkin <paskripkin@...il.com>
Cc:     syzbot <syzbot+f44badb06036334e867a@...kaller.appspotmail.com>,
        davem@...emloft.net, glider@...gle.com, kuba@...nel.org,
        linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
        linux@...pel-privat.de, netdev@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KMSAN: uninit-value in asix_mdio_read (2)

On Sun, Dec 19, 2021 at 12:14:30AM +0300, Pavel Skripkin wrote:
> On 12/18/21 14:07, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following issue on:
> > 
> > HEAD commit:    b0a8b5053e8b kmsan: core: add dependency on DEBUG_KERNEL
> > git tree:       https://github.com/google/kmsan.git master
> > console output: https://syzkaller.appspot.com/x/log.txt?x=13a4d133b00000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=46a956fc7a887c60
> > dashboard link: https://syzkaller.appspot.com/bug?extid=f44badb06036334e867a
> > compiler:       clang version 14.0.0 (/usr/local/google/src/llvm-git-monorepo 2b554920f11c8b763cd9ed9003f4e19b919b8e1f), GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=149fddcbb00000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17baef25b00000
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+f44badb06036334e867a@...kaller.appspotmail.com
> > 
> 
> The last unhanded case is asix_read_cmd() == 0. Let's handle it...

That does not look correct, i think.

asix_read_cmd() == 0 means no error from the read itself. If there is
no error, we should look at the value of smsr and test for bit
AX_HOST_EN. Doing a continue means we just ignore the value returned
by the good read.

I think the correct fix is to look at the value of i. If we have
exceeded 30, we should return -ETIMEDOUT.

	 Andrew