"Greg" == Greg KH gregkh@linuxfoundation.org writes:
On Tue, Oct 10, 2023 at 08:19:48AM +0200, Peter Korsgaard wrote:
> "Greg" == Greg KH gregkh@linuxfoundation.org writes:
On Tue, Oct 10, 2023 at 12:26:14AM +0200, Javier Carrasco wrote:
syzbot has found an uninit-value bug triggered by the dm9601 driver [1].
This error happens because the variable res is not updated if the call to dm_read_shared_word returns an error. In this particular case -EPROTO was returned and res stayed uninitialized.
This can be avoided by checking the return value of dm_read_shared_word and propagating the error if the read operation failed.
[1] https://syzkaller.appspot.com/bug?extid=1f53a30781af65d2c955
Signed-off-by: Javier Carrasco javier.carrasco.cruz@gmail.com Reported-and-tested-by: syzbot+1f53a30781af65d2c955@syzkaller.appspotmail.com
Changes in v2:
- Remove unnecessary 'err == 0' case
- Link to v1: https://lore.kernel.org/r/20231009-topic-dm9601_uninit_mdio_read-v1-1-d4d775...
drivers/net/usb/dm9601.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
What commit id does this fix?
It has been there since the beginning, so:
Fixes: d0374f4f9c35cdfbee0 ("USB: Davicom DM9601 usbnet driver")
Acked-by: Peter Korsgaard peter@korsgaard.com
Great, can someone add a cc: stable@ tag for this too please?
Cc: stable@vger.kernel.org
On Tue, Oct 10, 2023 at 09:22:49AM +0200, Peter Korsgaard wrote:
"Greg" == Greg KH gregkh@linuxfoundation.org writes:
On Tue, Oct 10, 2023 at 08:19:48AM +0200, Peter Korsgaard wrote:
>> "Greg" == Greg KH gregkh@linuxfoundation.org writes:
On Tue, Oct 10, 2023 at 12:26:14AM +0200, Javier Carrasco wrote:
syzbot has found an uninit-value bug triggered by the dm9601 driver [1].
This error happens because the variable res is not updated if the call to dm_read_shared_word returns an error. In this particular case -EPROTO was returned and res stayed uninitialized.
This can be avoided by checking the return value of dm_read_shared_word and propagating the error if the read operation failed.
[1] https://syzkaller.appspot.com/bug?extid=1f53a30781af65d2c955
Signed-off-by: Javier Carrasco javier.carrasco.cruz@gmail.com Reported-and-tested-by: syzbot+1f53a30781af65d2c955@syzkaller.appspotmail.com
Changes in v2:
- Remove unnecessary 'err == 0' case
- Link to v1: https://lore.kernel.org/r/20231009-topic-dm9601_uninit_mdio_read-v1-1-d4d775...
drivers/net/usb/dm9601.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
What commit id does this fix?
It has been there since the beginning, so:
Fixes: d0374f4f9c35cdfbee0 ("USB: Davicom DM9601 usbnet driver")
Acked-by: Peter Korsgaard peter@korsgaard.com
Great, can someone add a cc: stable@ tag for this too please?
Cc: stable@vger.kernel.org
<formletter>
This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly.
</formletter>
linux-stable-mirror@lists.linaro.org
-
Greg KH -
Peter Korsgaard