Hi,
On Mon, 3 Jan 2022 at 08:03, Greg KH greg@kroah.com wrote:
On Sun, Jan 02, 2022 at 08:19:43PM +0300, Pavel Skripkin wrote:
Alexander reported a use of uninitialized value in atusb_set_extended_addr(), that is caused by reading 0 bytes via usb_control_msg().
Since there is an API, that cannot read less bytes, than was requested, let's move atusb driver to use it. It will fix all potintial bugs with uninit values and make code more modern
Fail log:
BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline] BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2003bd ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [inline] atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") Cc: stable@vger.kernel.org # 5.9 Reported-by: Alexander Potapenko glider@google.com Signed-off-by: Pavel Skripkin paskripkin@gmail.com
drivers/net/ieee802154/atusb.c | 61 +++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 23 deletions(-)
diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c index 23ee0b14cbfa..43befea0110f 100644 --- a/drivers/net/ieee802154/atusb.c +++ b/drivers/net/ieee802154/atusb.c @@ -80,10 +80,9 @@ struct atusb_chip_data {
- in atusb->err and reject all subsequent requests until the error is cleared.
*/
-static int atusb_control_msg(struct atusb *atusb, unsigned int pipe,
__u8 request, __u8 requesttype,__u16 value, __u16 index,void *data, __u16 size, int timeout)+static int atusb_control_msg_recv(struct atusb *atusb, __u8 request, __u8 requesttype,
__u16 value, __u16 index,void *data, __u16 size, int timeout)Why do you need a wrapper function at all? Why not just call the real usb functions instead?
This driver has a lot of history, there is a comment which states:
"To reduce the number of error checks in the code, we record the first error in atusb->err and reject all subsequent requests until the error is cleared."
I think in the early state of this driver (as it was acting more as an USB<->SPI bridge) there was a lot of state handling involved. Nowadays we have a lot of such handling inside the device firmware (which is btw. open source). This might be not an excuse but an explanation why it was introduced in such a way.
...
I would recommend just moving to use the real USB functions and no wrapper function at all like this, it will make things more obvious and easier to understand over time.
okay.
- Alex