Re: KMSAN: uninit-value in alauda_check_media

Re: KMSAN: uninit-value in alauda_check_media

[Christophe JAILLET]

[-- Attachment #1: Type: text/plain, Size: 515 bytes --]

Hi,

(2nd try - text only format - sorry for the noise)


first try to use syzbot. I hope I do it right.
Discussion about the syz report can be found at 
https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/

This patch only test if alauda_get_media_status() (and its embedded 
usb_stor_ctrl_transfer()) before using the data.
In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.

#syz test: 
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

CJ


[-- Attachment #2: patch_alauda.c --]
[-- Type: text/x-csrc, Size: 983 bytes --]

diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 20b857e97e60..6c486d964911 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -318,7 +318,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
 	rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
 		command, 0xc0, 0, 1, data, 2);
 
-	usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
+	if (rc == USB_STOR_XFER_GOOD)
+		usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
 
 	return rc;
 }
@@ -453,8 +454,11 @@ static int alauda_check_media(struct us_data *us)
 {
 	struct alauda_info *info = (struct alauda_info *) us->extra;
 	unsigned char status[2];
+	int rc;
 
-	alauda_get_media_status(us, status);
+	rc = alauda_get_media_status(us, status);
+	if (rc != USB_STOR_TRANSPORT_GOOD)
+		return USB_STOR_TRANSPORT_ERROR;
 
 	/* Check for no media or door open */
 	if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)

Re: KMSAN: uninit-value in alauda_check_media

[syzbot]

> Hi,
>
> (2nd try - text only format - sorry for the noise)
>
>
> first try to use syzbot. I hope I do it right.
> Discussion about the syz report can be found at 
> https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/
>
> This patch only test if alauda_get_media_status() (and its embedded 
> usb_stor_ctrl_transfer()) before using the data.
> In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
>
> #syz test: 

KMSAN bugs can only be tested on https://github.com/google/kmsan.git tree
because KMSAN tool is not upstreamed yet.
See https://goo.gl/tpsmEJ#kmsan-bugs for details.

> git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
>
> CJ
>

Re: KMSAN: uninit-value in alauda_check_media

[syzbot]

> Hi,
>
> (3rd try - text only format, other git repo to please syzbot - sorry for 
> the noise)
>
>
> first try (ok, 3rd...) to use syzbot. I hope I do it right.
> Discussion about the syz report can be found at 
> https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org/ 
>
>
> This patch only test if alauda_get_media_status() (and its embedded 
> usb_stor_ctrl_transfer()) before using the data.
> In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
>
> #syz test: |https://github.com/google/kmsan.git| master

"|https://github.com/google/kmsan.git|" does not look like a valid git repo address.

>
> CJ

Re: KMSAN: uninit-value in alauda_check_media

[Alan Stern]

On Tue, Dec 28, 2021 at 08:47:15AM +0100, Christophe JAILLET wrote:
> Hi,
> 
> (2nd try - text only format - sorry for the noise)
> 
> 
> first try to use syzbot. I hope I do it right.
> Discussion about the syz report can be found at
> https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/
> 
> This patch only test if alauda_get_media_status() (and its embedded
> usb_stor_ctrl_transfer()) before using the data.
> In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
> 
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> master
> 
> CJ
> 

> diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
> index 20b857e97e60..6c486d964911 100644
> --- a/drivers/usb/storage/alauda.c
> +++ b/drivers/usb/storage/alauda.c
> @@ -318,7 +318,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
>  	rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
>  		command, 0xc0, 0, 1, data, 2);
>  
> -	usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
> +	if (rc == USB_STOR_XFER_GOOD)
> +		usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);

Instead of adding this test, you could initialize data[0] and data[1] 
to zero before the call to usb_stor_ctrl_transfer.

>  
>  	return rc;
>  }
> @@ -453,8 +454,11 @@ static int alauda_check_media(struct us_data *us)
>  {
>  	struct alauda_info *info = (struct alauda_info *) us->extra;
>  	unsigned char status[2];
> +	int rc;
>  
> -	alauda_get_media_status(us, status);
> +	rc = alauda_get_media_status(us, status);
> +	if (rc != USB_STOR_TRANSPORT_GOOD)
> +		return USB_STOR_TRANSPORT_ERROR;
>  
>  	/* Check for no media or door open */
>  	if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)

In general this looks fine.  Let us know when you are ready to submit 
the patch.

Alan Stern

Re: KMSAN: uninit-value in alauda_check_media

[Christophe JAILLET]

Le 28/12/2021 à 23:49, Alan Stern a écrit :
> On Tue, Dec 28, 2021 at 08:47:15AM +0100, Christophe JAILLET wrote:
>> Hi,
>>
>> (2nd try - text only format - sorry for the noise)
>>
>>
>> first try to use syzbot. I hope I do it right.
>> Discussion about the syz report can be found at
>> https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/
>>
>> This patch only test if alauda_get_media_status() (and its embedded
>> usb_stor_ctrl_transfer()) before using the data.
>> In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
>>
>> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
>> master
>>
>> CJ
>>
> 
>> diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
>> index 20b857e97e60..6c486d964911 100644
>> --- a/drivers/usb/storage/alauda.c
>> +++ b/drivers/usb/storage/alauda.c
>> @@ -318,7 +318,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
>>   	rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
>>   		command, 0xc0, 0, 1, data, 2);
>>   
>> -	usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
>> +	if (rc == USB_STOR_XFER_GOOD)
>> +		usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
> 
> Instead of adding this test, you could initialize data[0] and data[1]
> to zero before the call to usb_stor_ctrl_transfer.

Well, having the test is cleaner, IMHO.
If usb_stor_ctrl_transfer() fails, a message explaining the reason is 
already generated by the same usb_stor_dbg(). Having an error message 
followed by another one stating that the Media Status is 0x00 0x00 could 
be confusing I think.

Let me know if you have a real preference for a memset(data, 0, 2).
If so, I'll add it.

> 
>>   
>>   	return rc;
>>   }
>> @@ -453,8 +454,11 @@ static int alauda_check_media(struct us_data *us)
>>   {
>>   	struct alauda_info *info = (struct alauda_info *) us->extra;
>>   	unsigned char status[2];
>> +	int rc;
>>   
>> -	alauda_get_media_status(us, status);
>> +	rc = alauda_get_media_status(us, status);
>> +	if (rc != USB_STOR_TRANSPORT_GOOD)
>> +		return USB_STOR_TRANSPORT_ERROR;
>>   
>>   	/* Check for no media or door open */
>>   	if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
> 
> In general this looks fine.  Let us know when you are ready to submit
> the patch.

I was unsure that this patch would get any interest because the driver 
looks old. That's why I first tried to play with syzbot :)

In the syzbot history, you also mentioned that 'unsigned char status[2]' 
should be 'unsigned char *status = us->iobuf;'

This is more a blind fix for me, but it looks consistent with other 
places that call alauda_get_media_status().

So, once you confirm if you prefer my 'if' or a 'memset', I'll resend a 
small serie for fixing both issues.

CJ


> 
> Alan Stern
> 

Re: KMSAN: uninit-value in alauda_check_media

[Alan Stern]

On Wed, Dec 29, 2021 at 10:16:22AM +0100, Christophe JAILLET wrote:
> Le 28/12/2021 à 23:49, Alan Stern a écrit :
> > On Tue, Dec 28, 2021 at 08:47:15AM +0100, Christophe JAILLET wrote:
> > > Hi,
> > > 
> > > (2nd try - text only format - sorry for the noise)
> > > 
> > > 
> > > first try to use syzbot. I hope I do it right.
> > > Discussion about the syz report can be found at
> > > https://lore.kernel.org/linux-kernel/0000000000007d25ff059457342d@google.com/
> > > 
> > > This patch only test if alauda_get_media_status() (and its embedded
> > > usb_stor_ctrl_transfer()) before using the data.
> > > In case of error, it returns USB_STOR_TRANSPORT_ERROR as done elsewhere.
> > > 
> > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> > > master
> > > 
> > > CJ
> > > 
> > 
> > > diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
> > > index 20b857e97e60..6c486d964911 100644
> > > --- a/drivers/usb/storage/alauda.c
> > > +++ b/drivers/usb/storage/alauda.c
> > > @@ -318,7 +318,8 @@ static int alauda_get_media_status(struct us_data *us, unsigned char *data)
> > >   	rc = usb_stor_ctrl_transfer(us, us->recv_ctrl_pipe,
> > >   		command, 0xc0, 0, 1, data, 2);
> > > -	usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
> > > +	if (rc == USB_STOR_XFER_GOOD)
> > > +		usb_stor_dbg(us, "Media status %02X %02X\n", data[0], data[1]);
> > 
> > Instead of adding this test, you could initialize data[0] and data[1]
> > to zero before the call to usb_stor_ctrl_transfer.
> 
> Well, having the test is cleaner, IMHO.
> If usb_stor_ctrl_transfer() fails, a message explaining the reason is
> already generated by the same usb_stor_dbg(). Having an error message
> followed by another one stating that the Media Status is 0x00 0x00 could be
> confusing I think.
> 
> Let me know if you have a real preference for a memset(data, 0, 2).
> If so, I'll add it.
> 
> > 
> > >   	return rc;
> > >   }
> > > @@ -453,8 +454,11 @@ static int alauda_check_media(struct us_data *us)
> > >   {
> > >   	struct alauda_info *info = (struct alauda_info *) us->extra;
> > >   	unsigned char status[2];
> > > +	int rc;
> > > -	alauda_get_media_status(us, status);
> > > +	rc = alauda_get_media_status(us, status);
> > > +	if (rc != USB_STOR_TRANSPORT_GOOD)
> > > +		return USB_STOR_TRANSPORT_ERROR;
> > >   	/* Check for no media or door open */
> > >   	if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
> > 
> > In general this looks fine.  Let us know when you are ready to submit
> > the patch.
> 
> I was unsure that this patch would get any interest because the driver looks
> old. That's why I first tried to play with syzbot :)

It is indeed old.  I doubt very many devices of this type are still in 
use.

> In the syzbot history, you also mentioned that 'unsigned char status[2]'
> should be 'unsigned char *status = us->iobuf;'
> 
> This is more a blind fix for me, but it looks consistent with other places
> that call alauda_get_media_status().
> 
> So, once you confirm if you prefer my 'if' or a 'memset', I'll resend a
> small serie for fixing both issues.

"if" and "memset" are both acceptable.  You can use either one.

Alan Stern