From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>,
syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com,
syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com,
syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 20/44] media: gspca: zero usb_buf on error
Date: Sun, 22 Sep 2019 15:00:38 -0400 [thread overview]
Message-ID: <20190922190103.4906-20-sashal@kernel.org> (raw)
In-Reply-To: <20190922190103.4906-1-sashal@kernel.org>
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 4843a543fad3bf8221cf14e5d5f32d15cee89e84 ]
If reg_r() fails, then gspca_dev->usb_buf was left uninitialized,
and some drivers used the contents of that buffer in logic.
This caused several syzbot errors:
https://syzkaller.appspot.com/bug?extid=397fd082ce5143e2f67d
https://syzkaller.appspot.com/bug?extid=1a35278dd0ebfb3a038a
https://syzkaller.appspot.com/bug?extid=06ddf1788cfd048c5e82
I analyzed the gspca drivers and zeroed the buffer where needed.
Reported-and-tested-by: syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/gspca/konica.c | 5 +++++
drivers/media/usb/gspca/nw80x.c | 5 +++++
drivers/media/usb/gspca/ov519.c | 10 ++++++++++
drivers/media/usb/gspca/ov534.c | 5 +++++
drivers/media/usb/gspca/ov534_9.c | 1 +
drivers/media/usb/gspca/se401.c | 5 +++++
drivers/media/usb/gspca/sn9c20x.c | 5 +++++
drivers/media/usb/gspca/sonixb.c | 5 +++++
drivers/media/usb/gspca/sonixj.c | 5 +++++
drivers/media/usb/gspca/spca1528.c | 5 +++++
drivers/media/usb/gspca/sq930x.c | 5 +++++
drivers/media/usb/gspca/sunplus.c | 5 +++++
drivers/media/usb/gspca/vc032x.c | 5 +++++
drivers/media/usb/gspca/w996Xcf.c | 5 +++++
14 files changed, 71 insertions(+)
diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
index 0f6d57fbf91b7..624b4d24716dd 100644
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -127,6 +127,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index)
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, 2);
}
}
diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c
index 599f755e75b86..7ebeee98dc1bb 100644
--- a/drivers/media/usb/gspca/nw80x.c
+++ b/drivers/media/usb/gspca/nw80x.c
@@ -1584,6 +1584,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
return;
}
if (len == 1)
diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
index c95f32a0c02b4..c7aafdbb57384 100644
--- a/drivers/media/usb/gspca/ov519.c
+++ b/drivers/media/usb/gspca/ov519.c
@@ -2116,6 +2116,11 @@ static int reg_r(struct sd *sd, u16 index)
} else {
PERR("reg_r %02x failed %d\n", index, ret);
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
return ret;
@@ -2142,6 +2147,11 @@ static int reg_r8(struct sd *sd,
} else {
PERR("reg_r8 %02x failed %d\n", index, ret);
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, 8);
}
return ret;
diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
index bfff1d1c70ab0..466f984312ddb 100644
--- a/drivers/media/usb/gspca/ov534.c
+++ b/drivers/media/usb/gspca/ov534.c
@@ -644,6 +644,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
if (ret < 0) {
pr_err("read failed %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
return gspca_dev->usb_buf[0];
}
diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c
index 47085cf2d7236..f2dca06069355 100644
--- a/drivers/media/usb/gspca/ov534_9.c
+++ b/drivers/media/usb/gspca/ov534_9.c
@@ -1157,6 +1157,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg)
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ return 0;
}
return gspca_dev->usb_buf[0];
}
diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c
index 5102cea504710..6adbb0eca71fe 100644
--- a/drivers/media/usb/gspca/se401.c
+++ b/drivers/media/usb/gspca/se401.c
@@ -115,6 +115,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent)
pr_err("read req failed req %#04x error %d\n",
req, err);
gspca_dev->usb_err = err;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE);
}
}
diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c
index d0ee899584a9f..e5bd1e84fd875 100644
--- a/drivers/media/usb/gspca/sn9c20x.c
+++ b/drivers/media/usb/gspca/sn9c20x.c
@@ -924,6 +924,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
if (unlikely(result < 0 || result != length)) {
pr_err("Read register %02x failed %d\n", reg, result);
gspca_dev->usb_err = result;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 6696b2ec34e96..83e98b85ab6a1 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -466,6 +466,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
dev_err(gspca_dev->v4l2_dev.dev,
"Error reading register %02x: %d\n", value, res);
gspca_dev->usb_err = res;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
}
diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
index fd1c8706d86a8..67e23557a1a94 100644
--- a/drivers/media/usb/gspca/sonixj.c
+++ b/drivers/media/usb/gspca/sonixj.c
@@ -1175,6 +1175,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c
index f38fd8949609f..ee93bd443df5d 100644
--- a/drivers/media/usb/gspca/spca1528.c
+++ b/drivers/media/usb/gspca/spca1528.c
@@ -84,6 +84,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c
index e274cf19a3ea2..b236e9dcd4685 100644
--- a/drivers/media/usb/gspca/sq930x.c
+++ b/drivers/media/usb/gspca/sq930x.c
@@ -438,6 +438,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r %04x failed %d\n", value, ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index 46c9f2229a186..cc3e1478c5a09 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -268,6 +268,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c
index b4efb2fb36fa3..5032b9d7d9bb2 100644
--- a/drivers/media/usb/gspca/vc032x.c
+++ b/drivers/media/usb/gspca/vc032x.c
@@ -2919,6 +2919,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
static void reg_r(struct gspca_dev *gspca_dev,
diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c
index fb9fe2ef3a6f6..a74ac595656f7 100644
--- a/drivers/media/usb/gspca/w996Xcf.c
+++ b/drivers/media/usb/gspca/w996Xcf.c
@@ -139,6 +139,11 @@ static int w9968cf_read_sb(struct sd *sd)
} else {
pr_err("Read SB reg [01] failed\n");
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(sd->gspca_dev.usb_buf, 0, 2);
}
udelay(W9968CF_I2C_BUS_DELAY);
--
2.20.1
next prev parent reply other threads:[~2019-09-22 19:03 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-22 19:00 [PATCH AUTOSEL 4.4 01/44] ALSA: hda: Flush interrupts on disabling Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 02/44] ASoC: sgtl5000: Fix charge pump source assignment Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 03/44] dmaengine: bcm2835: Print error in case setting DMA mask fails Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 04/44] leds: leds-lp5562 allow firmware files up to the maximum length Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 05/44] media: dib0700: fix link error for dibx000_i2c_set_speed Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 06/44] media: hdpvr: Add device num check and handling Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 07/44] sched/fair: Fix imbalance due to CPU affinity Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 08/44] sched/core: Fix CPU controller for !RT_GROUP_SCHED Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 09/44] x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI fails Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 10/44] x86/apic: Soft disable APIC before initializing it Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 11/44] ALSA: hda - Show the fatal CORB/RIRB error more clearly Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 12/44] ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls() Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 13/44] media: iguanair: add sanity checks Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 14/44] base: soc: Export soc_device_register/unregister APIs Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 15/44] ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 16/44] ia64:unwind: fix double free for mod->arch.init_unw_table Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 17/44] md: don't call spare_active in md_reap_sync_thread if all member devices can't work Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 18/44] md: don't set In_sync if array is frozen Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 19/44] efi: cper: print AER info of PCIe fatal error Sasha Levin
2019-09-22 19:00 ` Sasha Levin [this message]
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 21/44] dmaengine: iop-adma: use correct printk format strings Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 22/44] media: omap3isp: Don't set streaming state on random subdevs Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 23/44] net: lpc-enet: fix printk format strings Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 24/44] media: radio/si470x: kill urb on error Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 25/44] media: hdpvr: add terminating 0 at end of string Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 26/44] media: saa7146: add cleanup in hexium_attach() Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 27/44] media: cpia2_usb: fix memory leaks Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 28/44] media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 29/44] media: ov9650: add a sanity check Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 30/44] ACPI / CPPC: do not require the _PSD method Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 31/44] libtraceevent: Change users plugin directory Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 32/44] ACPI: custom_method: fix memory leaks Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 33/44] hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap' Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 34/44] md/raid1: fail run raid1 array when active disk less than one Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 35/44] dmaengine: ti: edma: Do not reset reserved paRAM slots Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 36/44] kprobes: Prohibit probing on BUG() and WARN() address Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 37/44] irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 38/44] x86/platform/uv: Fix kmalloc() NULL check routine Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 39/44] ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 40/44] mmc: sdhci: Fix incorrect switch to HS mode Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 41/44] libertas: Add missing sentinel at end of if_usb.c fw_table Sasha Levin
2019-09-22 19:01 ` [PATCH AUTOSEL 4.4 42/44] media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() Sasha Levin
2019-09-22 19:01 ` [PATCH AUTOSEL 4.4 43/44] ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 Sasha Levin
2019-09-22 19:01 ` [PATCH AUTOSEL 4.4 44/44] btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190922190103.4906-20-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com \
--cc=syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com \
--cc=syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome