Commit 811cb972 authored Jun 25, 2021 by Dongliang Mu Committed by Greg Kroah-Hartman Sep 22, 2021

media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init



[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ]

If dibusb_read_eeprom_byte fails, the mac address is not initialized.
And nova_t_read_mac_address does not handle this failure, which leads to
the uninit-value in dvb_usb_adapter_dvb_init.

Fix this by handling the failure of dibusb_read_eeprom_byte.

Reported-by:  <syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com>
Fixes: 786baecf ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 01db625e

drivers/media/usb/dvb-usb/nova-t-usb2.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -133,7 +133,7 @@ static int nova_t_rc_query(struct dvb_usb_device d, u32 event, int *state)

		static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
		{
		int i;
		int i, ret;
		u8 b;

		mac[0] = 0x00;
		@@ -142,7 +142,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])

		/* this is a complete guess, but works for my box */
		for (i = 136; i < 139; i++) {
		dibusb_read_eeprom_byte(d,i, &b);
		ret = dibusb_read_eeprom_byte(d, i, &b);
		if (ret)
		return ret;

		mac[5 - (i - 136)] = b;
		}