* [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open
[not found] <202508272322.b4d5d8faea6996fd@syzkaller.appspotmail.com>
@ 2025-11-04 16:48 ` Dharanitharan R
2025-11-04 22:19 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: Dharanitharan R @ 2025-11-04 16:48 UTC (permalink / raw)
To: netdev
Cc: linux-usb, gregkh, davem, edumazet, kuba, pabeni,
syzbot+b4d5d8faea6996fd55e3, Dharanitharan R,
syzbot+b4d5d8faea6996fd
KMSAN reported an uninitialized value use in rtl8150_open().
Initialize rx_skb->data and intr_buff before submitting URBs to
ensure memory is in a defined state.
Reported-by: syzbot+b4d5d8faea6996fd@syzkaller.appspotmail.com
Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
---
drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 278e6cb6f4d9..f1a868f0032e 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
static void set_carrier(struct net_device *netdev)
{
- rtl8150_t *dev = netdev_priv(netdev);
- short tmp;
+ rtl8150_t *dev = netdev_priv(netdev);
+ short tmp;
- get_registers(dev, CSCR, 2, &tmp);
- if (tmp & CSCR_LINK_STATUS)
- netif_carrier_on(netdev);
- else
- netif_carrier_off(netdev);
+ /* Only use tmp if get_registers() succeeds */
+ if (!get_registers(dev, CSCR, 2, &tmp) &&
+ (tmp & CSCR_LINK_STATUS))
+ netif_carrier_on(netdev);
+ else
+ netif_carrier_off(netdev);
}
static int rtl8150_open(struct net_device *netdev)
@@ -741,6 +742,10 @@ static int rtl8150_open(struct net_device *netdev)
set_registers(dev, IDR, 6, netdev->dev_addr);
+ /* Fix: initialize memory before using it (KMSAN uninit-value) */
+ memset(dev->rx_skb->data, 0, RTL8150_MTU);
+ memset(dev->intr_buff, 0, INTBUFSIZE);
+
usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL))) {
@@ -749,6 +754,7 @@ static int rtl8150_open(struct net_device *netdev)
dev_warn(&netdev->dev, "rx_urb submit failed: %d\n", res);
return res;
}
+
usb_fill_int_urb(dev->intr_urb, dev->udev, usb_rcvintpipe(dev->udev, 3),
dev->intr_buff, INTBUFSIZE, intr_callback,
dev, dev->intr_interval);
@@ -759,6 +765,7 @@ static int rtl8150_open(struct net_device *netdev)
usb_kill_urb(dev->rx_urb);
return res;
}
+
enable_net_traffic(dev);
set_carrier(netdev);
netif_start_queue(netdev);
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open
2025-11-04 16:48 ` [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open Dharanitharan R
@ 2025-11-04 22:19 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2025-11-04 22:19 UTC (permalink / raw)
To: Dharanitharan R
Cc: netdev, linux-usb, davem, edumazet, kuba, pabeni,
syzbot+b4d5d8faea6996fd55e3, syzbot+b4d5d8faea6996fd
On Tue, Nov 04, 2025 at 04:48:37PM +0000, Dharanitharan R wrote:
> KMSAN reported an uninitialized value use in rtl8150_open().
> Initialize rx_skb->data and intr_buff before submitting URBs to
> ensure memory is in a defined state.
>
> Reported-by: syzbot+b4d5d8faea6996fd@syzkaller.appspotmail.com
> Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
> ---
> drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
> index 278e6cb6f4d9..f1a868f0032e 100644
> --- a/drivers/net/usb/rtl8150.c
> +++ b/drivers/net/usb/rtl8150.c
> @@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
>
> static void set_carrier(struct net_device *netdev)
> {
> - rtl8150_t *dev = netdev_priv(netdev);
> - short tmp;
> + rtl8150_t *dev = netdev_priv(netdev);
> + short tmp;
Always run checkpatch on your changes so you don't get grumpy
maintainers asking why you didn't run checkpatch on your change :)
Please fix and send a v2.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open
@ 2025-11-04 16:27 Dharanitharan R
2025-11-04 16:27 ` syzbot
2025-11-04 17:52 ` Andrew Lunn
0 siblings, 2 replies; 6+ messages in thread
From: Dharanitharan R @ 2025-11-04 16:27 UTC (permalink / raw)
To: netdev
Cc: linux-usb, gregkh, syzbot+b4d5d8faea6996fd, davem, edumazet, kuba,
pabeni, Dharanitharan R
KMSAN reported an uninitialized value use in rtl8150_open().
Initialize rx_skb->data and intr_buff before submitting URBs to
ensure memory is in a defined state.
Reported-by: syzbot+b4d5d8faea6996fd@syzkaller.appspotmail.com
Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
---
drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 278e6cb6f4d9..f1a868f0032e 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
static void set_carrier(struct net_device *netdev)
{
- rtl8150_t *dev = netdev_priv(netdev);
- short tmp;
+ rtl8150_t *dev = netdev_priv(netdev);
+ short tmp;
- get_registers(dev, CSCR, 2, &tmp);
- if (tmp & CSCR_LINK_STATUS)
- netif_carrier_on(netdev);
- else
- netif_carrier_off(netdev);
+ /* Only use tmp if get_registers() succeeds */
+ if (!get_registers(dev, CSCR, 2, &tmp) &&
+ (tmp & CSCR_LINK_STATUS))
+ netif_carrier_on(netdev);
+ else
+ netif_carrier_off(netdev);
}
static int rtl8150_open(struct net_device *netdev)
@@ -741,6 +742,10 @@ static int rtl8150_open(struct net_device *netdev)
set_registers(dev, IDR, 6, netdev->dev_addr);
+ /* Fix: initialize memory before using it (KMSAN uninit-value) */
+ memset(dev->rx_skb->data, 0, RTL8150_MTU);
+ memset(dev->intr_buff, 0, INTBUFSIZE);
+
usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL))) {
@@ -749,6 +754,7 @@ static int rtl8150_open(struct net_device *netdev)
dev_warn(&netdev->dev, "rx_urb submit failed: %d\n", res);
return res;
}
+
usb_fill_int_urb(dev->intr_urb, dev->udev, usb_rcvintpipe(dev->udev, 3),
dev->intr_buff, INTBUFSIZE, intr_callback,
dev, dev->intr_interval);
@@ -759,6 +765,7 @@ static int rtl8150_open(struct net_device *netdev)
usb_kill_urb(dev->rx_urb);
return res;
}
+
enable_net_traffic(dev);
set_carrier(netdev);
netif_start_queue(netdev);
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open
2025-11-04 16:27 Dharanitharan R
@ 2025-11-04 16:27 ` syzbot
2025-11-04 17:52 ` Andrew Lunn
1 sibling, 0 replies; 6+ messages in thread
From: syzbot @ 2025-11-04 16:27 UTC (permalink / raw)
To: dharanitharan725
Cc: davem, dharanitharan725, edumazet, gregkh, kuba, linux-usb,
netdev, pabeni
> KMSAN reported an uninitialized value use in rtl8150_open().
> Initialize rx_skb->data and intr_buff before submitting URBs to
> ensure memory is in a defined state.
>
> Reported-by: syzbot+b4d5d8faea6996fd@syzkaller.appspotmail.com
> Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
> ---
> drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
> index 278e6cb6f4d9..f1a868f0032e 100644
> --- a/drivers/net/usb/rtl8150.c
> +++ b/drivers/net/usb/rtl8150.c
> @@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
>
> static void set_carrier(struct net_device *netdev)
> {
> - rtl8150_t *dev = netdev_priv(netdev);
> - short tmp;
> + rtl8150_t *dev = netdev_priv(netdev);
> + short tmp;
>
> - get_registers(dev, CSCR, 2, &tmp);
> - if (tmp & CSCR_LINK_STATUS)
> - netif_carrier_on(netdev);
> - else
> - netif_carrier_off(netdev);
> + /* Only use tmp if get_registers() succeeds */
> + if (!get_registers(dev, CSCR, 2, &tmp) &&
> + (tmp & CSCR_LINK_STATUS))
> + netif_carrier_on(netdev);
> + else
> + netif_carrier_off(netdev);
> }
>
> static int rtl8150_open(struct net_device *netdev)
> @@ -741,6 +742,10 @@ static int rtl8150_open(struct net_device *netdev)
>
> set_registers(dev, IDR, 6, netdev->dev_addr);
>
> + /* Fix: initialize memory before using it (KMSAN uninit-value) */
> + memset(dev->rx_skb->data, 0, RTL8150_MTU);
> + memset(dev->intr_buff, 0, INTBUFSIZE);
> +
> usb_fill_bulk_urb(dev->rx_urb, dev->udev, usb_rcvbulkpipe(dev->udev, 1),
> dev->rx_skb->data, RTL8150_MTU, read_bulk_callback, dev);
> if ((res = usb_submit_urb(dev->rx_urb, GFP_KERNEL))) {
> @@ -749,6 +754,7 @@ static int rtl8150_open(struct net_device *netdev)
> dev_warn(&netdev->dev, "rx_urb submit failed: %d\n", res);
> return res;
> }
> +
> usb_fill_int_urb(dev->intr_urb, dev->udev, usb_rcvintpipe(dev->udev, 3),
> dev->intr_buff, INTBUFSIZE, intr_callback,
> dev, dev->intr_interval);
> @@ -759,6 +765,7 @@ static int rtl8150_open(struct net_device *netdev)
> usb_kill_urb(dev->rx_urb);
> return res;
> }
> +
> enable_net_traffic(dev);
> set_carrier(netdev);
> netif_start_queue(netdev);
> --
> 2.43.0
>
I see the command but can't find the corresponding bug.
The email is sent to syzbot+HASH@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open
2025-11-04 16:27 Dharanitharan R
2025-11-04 16:27 ` syzbot
@ 2025-11-04 17:52 ` Andrew Lunn
2025-11-04 17:52 ` syzbot
1 sibling, 1 reply; 6+ messages in thread
From: Andrew Lunn @ 2025-11-04 17:52 UTC (permalink / raw)
To: Dharanitharan R
Cc: netdev, linux-usb, gregkh, syzbot+b4d5d8faea6996fd, davem,
edumazet, kuba, pabeni
On Tue, Nov 04, 2025 at 04:27:16PM +0000, Dharanitharan R wrote:
> KMSAN reported an uninitialized value use in rtl8150_open().
> Initialize rx_skb->data and intr_buff before submitting URBs to
> ensure memory is in a defined state.
>
> Reported-by: syzbot+b4d5d8faea6996fd@syzkaller.appspotmail.com
> Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
> ---
> drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
> index 278e6cb6f4d9..f1a868f0032e 100644
> --- a/drivers/net/usb/rtl8150.c
> +++ b/drivers/net/usb/rtl8150.c
> @@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
>
> static void set_carrier(struct net_device *netdev)
> {
> - rtl8150_t *dev = netdev_priv(netdev);
> - short tmp;
> + rtl8150_t *dev = netdev_priv(netdev);
> + short tmp;
You are messing up the whitespace here.
Did you not read your own patch and notice this problem? checkpatch
probably also complained.
Andrew
---
pw-bot: cr
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open
2025-11-04 17:52 ` Andrew Lunn
@ 2025-11-04 17:52 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2025-11-04 17:52 UTC (permalink / raw)
To: andrew
Cc: andrew, davem, dharanitharan725, edumazet, gregkh, kuba,
linux-usb, netdev, pabeni
> On Tue, Nov 04, 2025 at 04:27:16PM +0000, Dharanitharan R wrote:
>> KMSAN reported an uninitialized value use in rtl8150_open().
>> Initialize rx_skb->data and intr_buff before submitting URBs to
>> ensure memory is in a defined state.
>>
>> Reported-by: syzbot+b4d5d8faea6996fd@syzkaller.appspotmail.com
>> Signed-off-by: Dharanitharan R <dharanitharan725@gmail.com>
>> ---
>> drivers/net/usb/rtl8150.c | 21 ++++++++++++++-------
>> 1 file changed, 14 insertions(+), 7 deletions(-)
>>
>> diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
>> index 278e6cb6f4d9..f1a868f0032e 100644
>> --- a/drivers/net/usb/rtl8150.c
>> +++ b/drivers/net/usb/rtl8150.c
>> @@ -719,14 +719,15 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
>>
>> static void set_carrier(struct net_device *netdev)
>> {
>> - rtl8150_t *dev = netdev_priv(netdev);
>> - short tmp;
>> + rtl8150_t *dev = netdev_priv(netdev);
>> + short tmp;
>
> You are messing up the whitespace here.
>
> Did you not read your own patch and notice this problem? checkpatch
> probably also complained.
>
> Andrew
>
> ---
> pw-bot: cr
I see the command but can't find the corresponding bug.
The email is sent to syzbot+HASH@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-11-04 22:19 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <202508272322.b4d5d8faea6996fd@syzkaller.appspotmail.com>
2025-11-04 16:48 ` [PATCH] [PATCH] usb: rtl8150: Initialize buffers to fix KMSAN uninit-value in rtl8150_open Dharanitharan R
2025-11-04 22:19 ` Greg KH
2025-11-04 16:27 Dharanitharan R
2025-11-04 16:27 ` syzbot
2025-11-04 17:52 ` Andrew Lunn
2025-11-04 17:52 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).