Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: gspca: zero usb_buf

Allocate gspca_dev->usb_buf with kzalloc instead of kmalloc to
ensure it is property zeroed. This fixes various syzbot errors
about uninitialized data.

Syzbot links:

https://syzkaller.appspot.com/bug?extid=32310fc2aea76898d074
https://syzkaller.appspot.com/bug?extid=99706d6390be1ac542a2
https://syzkaller.appspot.com/bug?extid=64437af5c781a7f0e08e

Reported-and-tested-by: syzbot+32310fc2aea76898d074@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+99706d6390be1ac542a2@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+64437af5c781a7f0e08e@syzkaller.appspotmail.com

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

authored by

Hans Verkuil and committed by
Mauro Carvalho Chehab
de89d086 aab7b7d1

+1 -1
+1 -1
drivers/media/usb/gspca/gspca.c
··· 1461 1461 pr_err("couldn't kzalloc gspca struct\n"); 1462 1462 return -ENOMEM; 1463 1463 } 1464 - gspca_dev->usb_buf = kmalloc(USB_BUF_SZ, GFP_KERNEL); 1464 + gspca_dev->usb_buf = kzalloc(USB_BUF_SZ, GFP_KERNEL); 1465 1465 if (!gspca_dev->usb_buf) { 1466 1466 pr_err("out of memory\n"); 1467 1467 ret = -ENOMEM;