Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Pavel Skripkin <paskripkin@gmail.com>
To: Petko Manolov <petkan@nucleusys.com>
Cc: davem@davemloft.net, kuba@kernel.org, linux-usb@vger.kernel.org,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com
Subject: Re: [PATCH] net: pegasus: fix uninit-value in get_interrupt_interval
Date: Sun, 1 Aug 2021 22:35:13 +0300	[thread overview]
Message-ID: <20210801223513.06bede26@gmail.com> (raw)
In-Reply-To: <YQaVS5UwG6RFsL4t@carbon>

On Sun, 1 Aug 2021 15:36:27 +0300
Petko Manolov <petkan@nucleusys.com> wrote:

> On 21-07-31 00:44:11, Pavel Skripkin wrote:
> > Syzbot reported uninit value pegasus_probe(). The problem was in
> > missing error handling.
> > 
> > get_interrupt_interval() internally calls read_eprom_word() which
> > can fail in some cases. For example: failed to receive usb control
> > message. These cases should be handled to prevent uninit value bug,
> > since read_eprom_word() will not initialize passed stack variable
> > in case of internal failure.
> 
> Well, this is most definitelly a bug.
> 
> ACK!
> 
> 
> 		Petko
> 
> 

Thank you, Petko!


BTW: I found a lot uses of {get,set}_registers without error
checking. I think, some of them could be fixed easily (like in
enable_eprom_write), but, I guess, disable_eprom_write is not so easy.
For example, if we cannot disable eprom should we retry? If not, will
device get in some unexpected state?

Im not familiar with this device, but I can prepare a patch to wrap all
these calls with proper error checking



With regards,
Pavel Skripkin



  reply	other threads:[~2021-08-01 19:35 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-30 21:44 Pavel Skripkin
2021-08-01 12:36 ` Petko Manolov
2021-08-01 19:35   ` Pavel Skripkin [this message]
2021-08-01 20:24     ` Petko Manolov
2021-08-02 20:07     ` Petko Manolov
2021-08-02 22:18       ` Pavel Skripkin
2021-08-03  5:36       ` Greg KH
2021-08-04 10:44 ` Pavel Skripkin
2021-08-04 11:58   ` Jakub Kicinski
2021-08-04 14:30     ` [PATCH net v2] " Pavel Skripkin
2021-08-05 14:50       ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210801223513.06bede26@gmail.com \
    --to=paskripkin@gmail.com \
    --cc=davem@davemloft.net \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=petkan@nucleusys.com \
    --cc=syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com \
    --subject='Re: [PATCH] net: pegasus: fix uninit-value in get_interrupt_interval' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).