netdev - Re: [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <690a2988.050a0220.98a6.00b3.GAE@google.com>
Date: Tue, 04 Nov 2025 08:27:52 -0800
From: syzbot <syzbot@...kaller.appspotmail.com>
To: dharanitharan725@...il.com
Cc: davem@...emloft.net, dharanitharan725@...il.com, edumazet@...gle.com, 
	gregkh@...uxfoundation.org, kuba@...nel.org, linux-usb@...r.kernel.org, 
	netdev@...r.kernel.org, pabeni@...hat.com
Subject: Re: [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN
 uninit-value in rtl8150_open

> KMSAN reported an uninitialized value use in rtl8150_open().
> Initialize rx_skb->data and intr_buff before submitting URBs to
> ensure memory is in a defined state.
>
> Reported-by: syzbot+b4d5d8faea6996fd@...kaller.appspotmail.com
> Signed-off-by: Dharanitharan R <dharanitharan725@...il.com>
> ---
>  drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
> index 278e6cb6f4d9..f1a868f0032e 100644
> --- a/drivers/net/usb/rtl8150.c
> +++ b/drivers/net/usb/rtl8150.c
> @@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
>  
>  static void set_carrier(struct net_device *netdev)
>  {
> -	rtl8150_t *dev = netdev_priv(netdev);
> -	short tmp;
> +    rtl8150_t *dev = netdev_priv(netdev);
> +    short tmp;
>  
> -	get_registers(dev, CSCR, 2, &tmp);
> -	if (tmp & CSCR_LINK_STATUS)
> -		netif_carrier_on(netdev);
> -	else
> -		netif_carrier_off(netdev);
> +    /* Only use tmp if get_registers() succeeds */
> +    if (!get_registers(dev, CSCR, 2, &tmp) &&
> +        (tmp & CSCR_LINK_STATUS))
> +        netif_carrier_on(netdev);
> +    else
> +        netif_carrier_off(netdev);
>  }
>  
>  static int rtl8150_open(struct net_device *netdev)
> @@ -741,6 +742,10 @@ static int rtl8150_open(struct net_device *netdev)
>  
>  	set_registers(dev, IDR, 6, netdev->dev_addr);
>  
> +	/* Fix: initialize memory before using it (KMSAN uninit-value) */
> +	memset(dev->rx_skb->data, 0, RTL8150_MTU);
> +	memset(dev->intr_buff, 0, INTBUFSIZE);
> +
>  	usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
>  		      dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
>  	if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL))) {
> @@ -749,6 +754,7 @@ static int rtl8150_open(struct net_device *netdev)
>  		dev_warn(&netdev->dev, "rx_urb submit failed: %d\n", res);
>  		return res;
>  	}
> +
>  	usb_fill_int_urb(dev->intr_urb, dev->udev, usb_rcvintpipe(dev->udev, 3),
>  		     dev->intr_buff, INTBUFSIZE, intr_callback,
>  		     dev, dev->intr_interval);
> @@ -759,6 +765,7 @@ static int rtl8150_open(struct net_device *netdev)
>  		usb_kill_urb(dev->rx_urb);
>  		return res;
>  	}
> +
>  	enable_net_traffic(dev);
>  	set_carrier(netdev);
>  	netif_start_queue(netdev);
> -- 
> 2.43.0
>

I see the command but can't find the corresponding bug.
The email is sent to  syzbot+HASH@...kaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.