From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>,
syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com,
syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com,
syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 23/60] media: gspca: zero usb_buf on error
Date: Sun, 22 Sep 2019 14:58:56 -0400 [thread overview]
Message-ID: <20190922185934.4305-23-sashal@kernel.org> (raw)
In-Reply-To: <20190922185934.4305-1-sashal@kernel.org>
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 4843a543fad3bf8221cf14e5d5f32d15cee89e84 ]
If reg_r() fails, then gspca_dev->usb_buf was left uninitialized,
and some drivers used the contents of that buffer in logic.
This caused several syzbot errors:
https://syzkaller.appspot.com/bug?extid=397fd082ce5143e2f67d
https://syzkaller.appspot.com/bug?extid=1a35278dd0ebfb3a038a
https://syzkaller.appspot.com/bug?extid=06ddf1788cfd048c5e82
I analyzed the gspca drivers and zeroed the buffer where needed.
Reported-and-tested-by: syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/gspca/konica.c | 5 +++++
drivers/media/usb/gspca/nw80x.c | 5 +++++
drivers/media/usb/gspca/ov519.c | 10 ++++++++++
drivers/media/usb/gspca/ov534.c | 5 +++++
drivers/media/usb/gspca/ov534_9.c | 1 +
drivers/media/usb/gspca/se401.c | 5 +++++
drivers/media/usb/gspca/sn9c20x.c | 5 +++++
drivers/media/usb/gspca/sonixb.c | 5 +++++
drivers/media/usb/gspca/sonixj.c | 5 +++++
drivers/media/usb/gspca/spca1528.c | 5 +++++
drivers/media/usb/gspca/sq930x.c | 5 +++++
drivers/media/usb/gspca/sunplus.c | 5 +++++
drivers/media/usb/gspca/vc032x.c | 5 +++++
drivers/media/usb/gspca/w996Xcf.c | 5 +++++
14 files changed, 71 insertions(+)
diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
index 78542fff403fc..5a37d32e8fd09 100644
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -127,6 +127,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index)
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, 2);
}
}
diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c
index 599f755e75b86..7ebeee98dc1bb 100644
--- a/drivers/media/usb/gspca/nw80x.c
+++ b/drivers/media/usb/gspca/nw80x.c
@@ -1584,6 +1584,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
return;
}
if (len == 1)
diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
index 965372a5ff2f3..7ac38905080ad 100644
--- a/drivers/media/usb/gspca/ov519.c
+++ b/drivers/media/usb/gspca/ov519.c
@@ -2087,6 +2087,11 @@ static int reg_r(struct sd *sd, u16 index)
} else {
PERR("reg_r %02x failed %d\n", index, ret);
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
return ret;
@@ -2115,6 +2120,11 @@ static int reg_r8(struct sd *sd,
} else {
PERR("reg_r8 %02x failed %d\n", index, ret);
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, 8);
}
return ret;
diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
index 9266a5c9abc5d..ba289b4530772 100644
--- a/drivers/media/usb/gspca/ov534.c
+++ b/drivers/media/usb/gspca/ov534.c
@@ -645,6 +645,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
if (ret < 0) {
pr_err("read failed %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
return gspca_dev->usb_buf[0];
}
diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c
index 47085cf2d7236..f2dca06069355 100644
--- a/drivers/media/usb/gspca/ov534_9.c
+++ b/drivers/media/usb/gspca/ov534_9.c
@@ -1157,6 +1157,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg)
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ return 0;
}
return gspca_dev->usb_buf[0];
}
diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c
index 5102cea504710..6adbb0eca71fe 100644
--- a/drivers/media/usb/gspca/se401.c
+++ b/drivers/media/usb/gspca/se401.c
@@ -115,6 +115,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent)
pr_err("read req failed req %#04x error %d\n",
req, err);
gspca_dev->usb_err = err;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE);
}
}
diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c
index 10269dad9d201..1a08a7a20114c 100644
--- a/drivers/media/usb/gspca/sn9c20x.c
+++ b/drivers/media/usb/gspca/sn9c20x.c
@@ -923,6 +923,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
if (unlikely(result < 0 || result != length)) {
pr_err("Read register %02x failed %d\n", reg, result);
gspca_dev->usb_err = result;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 6696b2ec34e96..83e98b85ab6a1 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -466,6 +466,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
dev_err(gspca_dev->v4l2_dev.dev,
"Error reading register %02x: %d\n", value, res);
gspca_dev->usb_err = res;
+ /*
+ * Make sure the result is zeroed to avoid uninitialized
+ * values.
+ */
+ gspca_dev->usb_buf[0] = 0;
}
}
diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
index d49d76ec14212..9ec63f75b8ea4 100644
--- a/drivers/media/usb/gspca/sonixj.c
+++ b/drivers/media/usb/gspca/sonixj.c
@@ -1174,6 +1174,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c
index f38fd8949609f..ee93bd443df5d 100644
--- a/drivers/media/usb/gspca/spca1528.c
+++ b/drivers/media/usb/gspca/spca1528.c
@@ -84,6 +84,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c
index e274cf19a3ea2..b236e9dcd4685 100644
--- a/drivers/media/usb/gspca/sq930x.c
+++ b/drivers/media/usb/gspca/sq930x.c
@@ -438,6 +438,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r %04x failed %d\n", value, ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
index 46c9f2229a186..cc3e1478c5a09 100644
--- a/drivers/media/usb/gspca/sunplus.c
+++ b/drivers/media/usb/gspca/sunplus.c
@@ -268,6 +268,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c
index b4efb2fb36fa3..5032b9d7d9bb2 100644
--- a/drivers/media/usb/gspca/vc032x.c
+++ b/drivers/media/usb/gspca/vc032x.c
@@ -2919,6 +2919,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev,
if (ret < 0) {
pr_err("reg_r err %d\n", ret);
gspca_dev->usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
}
}
static void reg_r(struct gspca_dev *gspca_dev,
diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c
index 896f1b2b91793..948aaae4d47eb 100644
--- a/drivers/media/usb/gspca/w996Xcf.c
+++ b/drivers/media/usb/gspca/w996Xcf.c
@@ -147,6 +147,11 @@ static int w9968cf_read_sb(struct sd *sd)
} else {
pr_err("Read SB reg [01] failed\n");
sd->gspca_dev.usb_err = ret;
+ /*
+ * Make sure the buffer is zeroed to avoid uninitialized
+ * values.
+ */
+ memset(sd->gspca_dev.usb_buf, 0, 2);
}
udelay(W9968CF_I2C_BUS_DELAY);
--
2.20.1
next prev parent reply other threads:[~2019-09-22 19:07 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-22 18:58 [PATCH AUTOSEL 4.9 01/60] ALSA: hda: Flush interrupts on disabling Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 02/60] regulator: lm363x: Fix off-by-one n_voltages for lm3632 ldo_vpos/ldo_vneg Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 03/60] ASoC: sgtl5000: Fix charge pump source assignment Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 04/60] dmaengine: bcm2835: Print error in case setting DMA mask fails Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 05/60] leds: leds-lp5562 allow firmware files up to the maximum length Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 06/60] media: dib0700: fix link error for dibx000_i2c_set_speed Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 07/60] media: exynos4-is: fix leaked of_node references Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 08/60] media: hdpvr: Add device num check and handling Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 09/60] sched/fair: Fix imbalance due to CPU affinity Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 10/60] sched/core: Fix CPU controller for !RT_GROUP_SCHED Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 11/60] x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI fails Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 12/60] x86/apic: Soft disable APIC before initializing it Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 13/60] ALSA: hda - Show the fatal CORB/RIRB error more clearly Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 14/60] ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls() Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 15/60] media: iguanair: add sanity checks Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 16/60] base: soc: Export soc_device_register/unregister APIs Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 17/60] ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 18/60] ia64:unwind: fix double free for mod->arch.init_unw_table Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 19/60] EDAC/altera: Use the proper type for the IRQ status bits Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 20/60] md: don't call spare_active in md_reap_sync_thread if all member devices can't work Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 21/60] md: don't set In_sync if array is frozen Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 22/60] efi: cper: print AER info of PCIe fatal error Sasha Levin
2019-09-22 18:58 ` Sasha Levin [this message]
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 24/60] dmaengine: iop-adma: use correct printk format strings Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 25/60] media: omap3isp: Don't set streaming state on random subdevs Sasha Levin
2019-09-22 18:58 ` [PATCH AUTOSEL 4.9 26/60] net: lpc-enet: fix printk format strings Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 27/60] ARM: dts: imx7d: cl-som-imx7: make ethernet work again Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 28/60] media: radio/si470x: kill urb on error Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 29/60] media: hdpvr: add terminating 0 at end of string Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 30/60] media: dvb-core: fix a memory leak bug Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 31/60] PM / devfreq: passive: Use non-devm notifiers Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 32/60] PM / devfreq: exynos-bus: Correct clock enable sequence Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 33/60] media: saa7146: add cleanup in hexium_attach() Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 34/60] media: cpia2_usb: fix memory leaks Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 35/60] media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 36/60] media: ov9650: add a sanity check Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 37/60] ACPI / CPPC: do not require the _PSD method Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 38/60] arm64: kpti: ensure patched kernel text is fetched from PoU Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 39/60] nvmet: fix data units read and written counters in SMART log Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 40/60] iommu/amd: Silence warnings under memory pressure Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 41/60] libtraceevent: Change users plugin directory Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 42/60] ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 43/60] ACPI: custom_method: fix memory leaks Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 44/60] ACPI / PCI: fix acpi_pci_irq_enable() memory leak Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 45/60] hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap' Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 46/60] md/raid1: fail run raid1 array when active disk less than one Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 47/60] dmaengine: ti: edma: Do not reset reserved paRAM slots Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 48/60] kprobes: Prohibit probing on BUG() and WARN() address Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 49/60] s390/crypto: xts-aes-s390 fix extra run-time crypto self tests finding Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 50/60] irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 51/60] x86/platform/uv: Fix kmalloc() NULL check routine Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 52/60] ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 53/60] mmc: sdhci: Fix incorrect switch to HS mode Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 54/60] media: technisat-usb2: break out of loop at end of buffer Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 55/60] libertas: Add missing sentinel at end of if_usb.c fw_table Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 56/60] e1000e: add workaround for possible stalled packet Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 57/60] drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 58/60] media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 59/60] ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 Sasha Levin
2019-09-22 18:59 ` [PATCH AUTOSEL 4.9 60/60] btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190922185934.4305-23-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com \
--cc=syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com \
--cc=syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).