Re: [syzbot] [usb?] KMSAN: kernel-usb-infoleak in usbtmc_write
From: Edward Adam Davis
Date: Fri Sep 06 2024 - 08:07:12 EST
Clear the buffer that has not been set, after copying data from user space.
#syz test
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 6bd9fe565385..5159f1c01116 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1590,6 +1590,8 @@ static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
up(&file_data->limit_write_sem);
goto exit;
}
+ memset(&buffer[USBTMC_HEADER_SIZE + transfersize], 0,
+ aligned - USBTMC_HEADER_SIZE - transfersize);
dev_dbg(&data->intf->dev, "%s(size:%u align:%u)\n", __func__,
(unsigned int)transfersize, (unsigned int)aligned);