Tue Apr 19 01:35:28 2022 UTC ()
umcs(4): Avoid using uninitialized data if register read fails.

Reported-by: syzbot+511b32f415150b469250@syzkaller.appspotmail.com


(riastradh)
diff -r1.18 -r1.19 src/sys/dev/usb/umcs.c
cvs diff -r1.18 -r1.19 src/sys/dev/usb/umcs.c (expand / switch to unified diff)

--- src/sys/dev/usb/umcs.c 2022/02/09 07:32:33 1.18
+++ src/sys/dev/usb/umcs.c 2022/04/19 01:35:28 1.19
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: umcs.c,v 1.18 2022/02/09 07:32:33 mrg Exp $ */ 1/* $NetBSD: umcs.c,v 1.19 2022/04/19 01:35:28 riastradh Exp $ */
2/* $FreeBSD: head/sys/dev/usb/serial/umcs.c 260559 2014-01-12 11:44:28Z hselasky $ */ 2/* $FreeBSD: head/sys/dev/usb/serial/umcs.c 260559 2014-01-12 11:44:28Z hselasky $ */
3 3
4/*- 4/*-
5 * Copyright (c) 2010 Lev Serebryakov <lev@FreeBSD.org>. 5 * Copyright (c) 2010 Lev Serebryakov <lev@FreeBSD.org>.
6 * All rights reserved. 6 * All rights reserved.
7 * 7 *
8 * Redistribution and use in source and binary forms, with or without 8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions 9 * modification, are permitted provided that the following conditions
10 * are met: 10 * are met:
11 * 1. Redistributions of source code must retain the above copyright 11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer. 12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright 13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the 14 * notice, this list of conditions and the following disclaimer in the
@@ -31,27 +31,27 @@ @@ -31,27 +31,27 @@
31 * This driver supports several multiport USB-to-RS232 serial adapters driven 31 * This driver supports several multiport USB-to-RS232 serial adapters driven
32 * by MosChip mos7820 and mos7840, bridge chips. 32 * by MosChip mos7820 and mos7840, bridge chips.
33 * The adapters are sold under many different brand names. 33 * The adapters are sold under many different brand names.
34 * 34 *
35 * Datasheets are available at MosChip www site at 35 * Datasheets are available at MosChip www site at
36 * http://www.moschip.com. The datasheets don't contain full 36 * http://www.moschip.com. The datasheets don't contain full
37 * programming information for the chip. 37 * programming information for the chip.
38 * 38 *
39 * It is nornal to have only two enabled ports in devices, based on 39 * It is nornal to have only two enabled ports in devices, based on
40 * quad-port mos7840. 40 * quad-port mos7840.
41 * 41 *
42 */ 42 */
43#include <sys/cdefs.h> 43#include <sys/cdefs.h>
44__KERNEL_RCSID(0, "$NetBSD: umcs.c,v 1.18 2022/02/09 07:32:33 mrg Exp $"); 44__KERNEL_RCSID(0, "$NetBSD: umcs.c,v 1.19 2022/04/19 01:35:28 riastradh Exp $");
45 45
46#include <sys/param.h> 46#include <sys/param.h>
47#include <sys/systm.h> 47#include <sys/systm.h>
48#include <sys/atomic.h> 48#include <sys/atomic.h>
49#include <sys/kernel.h> 49#include <sys/kernel.h>
50#include <sys/conf.h> 50#include <sys/conf.h>
51#include <sys/tty.h> 51#include <sys/tty.h>
52#include <sys/device.h> 52#include <sys/device.h>
53#include <sys/kmem.h> 53#include <sys/kmem.h>
54 54
55#include <dev/usb/usb.h> 55#include <dev/usb/usb.h>
56#include <dev/usb/usbdi.h> 56#include <dev/usb/usbdi.h>
57#include <dev/usb/usbdi_util.h> 57#include <dev/usb/usbdi_util.h>
@@ -216,28 +216,28 @@ umcs7840_attach(device_t parent, device_ @@ -216,28 +216,28 @@ umcs7840_attach(device_t parent, device_
216 216
217 /* 217 /*
218 * Get number of ports 218 * Get number of ports
219 * Documentation (full datasheet) says, that number of ports is 219 * Documentation (full datasheet) says, that number of ports is
220 * set as MCS7840_DEV_MODE_SELECT24S bit in MODE R/Only 220 * set as MCS7840_DEV_MODE_SELECT24S bit in MODE R/Only
221 * register. But vendor driver uses these undocumented 221 * register. But vendor driver uses these undocumented
222 * register & bit. 222 * register & bit.
223 * 223 *
224 * Experiments show, that MODE register can have `0' 224 * Experiments show, that MODE register can have `0'
225 * (4 ports) bit on 2-port device, so use vendor driver's way. 225 * (4 ports) bit on 2-port device, so use vendor driver's way.
226 * 226 *
227 * Also, see notes in header file for these constants. 227 * Also, see notes in header file for these constants.
228 */ 228 */
229 umcs7840_get_reg(sc, MCS7840_DEV_REG_GPIO, &data); 229 error = umcs7840_get_reg(sc, MCS7840_DEV_REG_GPIO, &data);
230 if (data & MCS7840_DEV_GPIO_4PORTS) { 230 if (error == 0 && (data & MCS7840_DEV_GPIO_4PORTS) != 0) {
231 sc->sc_numports = 4; 231 sc->sc_numports = 4;
232 /* physical port no are : 0, 1, 2, 3 */ 232 /* physical port no are : 0, 1, 2, 3 */
233 } else { 233 } else {
234 if (uaa->uaa_product == USB_PRODUCT_MOSCHIP_MCS7810) 234 if (uaa->uaa_product == USB_PRODUCT_MOSCHIP_MCS7810)
235 sc->sc_numports = 1; 235 sc->sc_numports = 1;
236 else { 236 else {
237 sc->sc_numports = 2; 237 sc->sc_numports = 2;
238 /* physical port no are : 0 and 2 */ 238 /* physical port no are : 0 and 2 */
239 } 239 }
240 } 240 }
241 devinfop = usbd_devinfo_alloc(dev, 0); 241 devinfop = usbd_devinfo_alloc(dev, 0);
242 aprint_normal(": %s\n", devinfop); 242 aprint_normal(": %s\n", devinfop);
243 usbd_devinfo_free(devinfop); 243 usbd_devinfo_free(devinfop);