Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3304a6d authored by Dongliang Mu's avatar Dongliang Mu Committed by Greg Kroah-Hartman
Browse files

usb: idmouse: fix an uninit-value in idmouse_open 



[ Upstream commit bce2b0539933e485d22d6f6f076c0fcd6f185c4c ]

In idmouse_create_image, if any ftip_command fails, it will
go to the reset label. However, this leads to the data in
bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check
for valid image incurs an uninitialized dereference.

Fix this by moving the check before reset label since this
check only be valid if the data after bulk_in_buffer[HEADER]
has concrete data.

Note that this is found by KMSAN, so only kernel compilation
is tested.

Reported-by: default avatar <syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com>
Signed-off-by: default avatarDongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20220922134847.1101921-1-dzm91@hust.edu.cn


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7f214204

drivers/usb/misc/idmouse.c

+4 −4
Original line number Diff line number Diff line
@@ -183,10 +183,6 @@ static int idmouse_create_image(struct usb_idmouse *dev) 
		bytes_read += bulk_read;

	}



	/* reset the device */

reset:

	ftip_command(dev, FTIP_RELEASE, 0, 0);



	/* check for valid image */

	/* right border should be black (0x00) */

	for (bytes_read = sizeof(HEADER)-1 + WIDTH-1; bytes_read < IMGSIZE; bytes_read += WIDTH)
@@ -198,6 +194,10 @@ static int idmouse_create_image(struct usb_idmouse *dev) 
		if (dev->bulk_in_buffer[bytes_read] != 0xFF)

			return -EAGAIN;



	/* reset the device */

reset:

	ftip_command(dev, FTIP_RELEASE, 0, 0);



	/* should be IMGSIZE == 65040 */

	dev_dbg(&dev->interface->dev, "read %d bytes fingerprint data\n",

		bytes_read);