From: Petko Manolov <petkan@nucleusys.com>
To: Denis Kirjanov <kda@linux-powerpc.org>
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: Re: [PATCH] net: usb: pegasus: fix improper read if get_registers() fail
Date: Wed, 31 Jul 2019 22:10:40 +0300 [thread overview]
Message-ID: <20190731191039.gip2sttd2og2olx6@carbon> (raw)
In-Reply-To: <20190730131357.30697-1-dkirjanov@suse.com>
On 19-07-30 15:13:57, Denis Kirjanov wrote:
> get_registers() may fail with -ENOMEM and in this
> case we can read a garbage from the status variable tmp.
>
> Reported-by: syzbot+3499a83b2d062ae409d4@syzkaller.appspotmail.com
> Signed-off-by: Denis Kirjanov <kda@linux-powerpc.org>
> ---
> drivers/net/usb/pegasus.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
> index 6d25dea5ad4b..f7d117d80cfb 100644
> --- a/drivers/net/usb/pegasus.c
> +++ b/drivers/net/usb/pegasus.c
> @@ -282,7 +282,7 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val)
> static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata)
> {
> int i;
> - __u8 tmp;
> + __u8 tmp = 0;
> __le16 retdatai;
> int ret;
Unfortunately this patch does not fix anything. Even if get_registers() fail
with -ENOMEM the "for" loop will cover for it and will exit only if the
operation was successful or the device got disconnected. Please read the code
carefully.
So while the patch is harmless it isn't solving a problem.
cheers,
Petko
next prev parent reply other threads:[~2019-07-31 19:41 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-30 13:13 [PATCH] net: usb: pegasus: fix improper read if get_registers() fail Denis Kirjanov
2019-07-30 17:24 ` David Miller
2019-07-30 18:23 ` Denis Kirjanov
[not found] ` <CAHj3AVm2EZB7n9UBxiBmA+6XN+EgAC_FRoHjh6kO3WMT8KVd6g@mail.gmail.com>
2019-07-30 21:10 ` David Miller
2019-07-31 19:10 ` Petko Manolov [this message]
2019-07-31 19:14 ` Petko Manolov
2019-08-01 22:18 ` David Miller
-- strict thread matches above, loose matches on Subject: below --
2019-07-30 12:45 Denis Kirjanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190731191039.gip2sttd2og2olx6@carbon \
--to=petkan@nucleusys.com \
--cc=davem@davemloft.net \
--cc=kda@linux-powerpc.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox