Re: [syzbot] [usb?] KMSAN: kernel-usb-infoleak in usbtmc_write

[Edward Adam Davis]

Clear the buffer that has not been set, after copying data from user space.

#syz test

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 6bd9fe565385..5159f1c01116 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1590,6 +1590,8 @@ static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
 		up(&file_data->limit_write_sem);
 		goto exit;
 	}
+	memset(&buffer[USBTMC_HEADER_SIZE + transfersize], 0,
+		aligned - USBTMC_HEADER_SIZE - transfersize);
 
 	dev_dbg(&data->intf->dev, "%s(size:%u align:%u)\n", __func__,
 		(unsigned int)transfersize, (unsigned int)aligned);