[Linux-kernel-mentees] [PATCH] usb: asix: Fix uninit-value in asix_mdio_write

David Miller davem at davemloft.net
Thu Nov 7 23:21:18 UTC 2019


From: Phong Tran <tranmanphong at gmail.com>
Date: Thu,  7 Nov 2019 07:44:04 +0700

> The local variables use without initilization value.
> This fixes the syzbot report.
> 
> Reported-by: syzbot+7dc7c28d4577bbe55b10 at syzkaller.appspotmail.com
> 
> Test result:
> 
> https://groups.google.com/d/msg/syzkaller-bugs/3H_n05x_sPU/sUoHhxgAAgAJ
> 
> Signed-off-by: Phong Tran <tranmanphong at gmail.com>

There are several more situations in this file where the data blob passed
to asix_read_cmd() is read without pre-initialization not checking the
return value from asix_read_cmd().

So, syzbot can see some of them but not all of them, yet all of them
are buggy and should be fixed.

These kinds of patches drive me absolutely crazy :-)

Really, one of two things needs to happen, either asix_read_cmd() clears
the incoming buffer unconditionally, or these call sites strictly must
check the return value always before accessing the buffer after the call.

I'm not applying this, sorry.


More information about the Linux-kernel-mentees mailing list