mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-15 23:25:07 +00:00
bce2b05399
In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested. Reported-by: syzbot+79832d33eb89fb3cd092@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Link: https://lore.kernel.org/r/20220922134847.1101921-1-dzm91@hust.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| sisusbvga | ||
| adutux.c | ||
| apple-mfi-fastcharge.c | ||
| appledisplay.c | ||
| brcmstb-usb-pinmap.c | ||
| chaoskey.c | ||
| cypress_cy7c63.c | ||
| cytherm.c | ||
| ehset.c | ||
| emi26.c | ||
| emi62.c | ||
| ezusb.c | ||
| ftdi-elan.c | ||
| idmouse.c | ||
| iowarrior.c | ||
| isight_firmware.c | ||
| Kconfig | ||
| ldusb.c | ||
| legousbtower.c | ||
| lvstest.c | ||
| Makefile | ||
| onboard_usb_hub.c | ||
| onboard_usb_hub.h | ||
| onboard_usb_hub_pdevs.c | ||
| qcom_eud.c | ||
| trancevibrator.c | ||
| usb251xb.c | ||
| usb3503.c | ||
| usb4604.c | ||
| usb_u132.h | ||
| usblcd.c | ||
| usbsevseg.c | ||
| usbtest.c | ||
| uss720.c | ||
| yurex.c | ||