Execution of a PSMOUSE_CMD_GET* command may fail, leaving the output buffer uninitialized. Make sure to check the return value of ps2_command() and bail out before checking the buffer contents. The use of uninitialized data in genius_detect() was detected by KMSAN, other places were fixed for the sake of uniformity. Signed-off-by: Alexander Potapenko <glider@xxxxxxxxxx> --- drivers/input/mouse/psmouse-base.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c index 0b4a3039f312f..a3305653ce891 100644 --- a/drivers/input/mouse/psmouse-base.c +++ b/drivers/input/mouse/psmouse-base.c @@ -546,13 +546,16 @@ static int genius_detect(struct psmouse *psmouse, bool set_properties) { struct ps2dev *ps2dev = &psmouse->ps2dev; u8 param[4]; + int error; param[0] = 3; ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES); ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11); ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11); ps2_command(ps2dev, NULL, PSMOUSE_CMD_SETSCALE11); - ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO); + error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO); + if (error) + return error; if (param[0] != 0x00 || param[1] != 0x33 || param[2] != 0x55) return -ENODEV; @@ -578,6 +581,7 @@ static int intellimouse_detect(struct psmouse *psmouse, bool set_properties) { struct ps2dev *ps2dev = &psmouse->ps2dev; u8 param[2]; + int error; param[0] = 200; ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); @@ -585,7 +589,9 @@ static int intellimouse_detect(struct psmouse *psmouse, bool set_properties) ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); param[0] = 80; ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); - ps2_command(ps2dev, param, PSMOUSE_CMD_GETID); + error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETID); + if (error) + return error; if (param[0] != 3) return -ENODEV; @@ -611,6 +617,7 @@ static int im_explorer_detect(struct psmouse *psmouse, bool set_properties) { struct ps2dev *ps2dev = &psmouse->ps2dev; u8 param[2]; + int error; intellimouse_detect(psmouse, 0); @@ -620,7 +627,9 @@ static int im_explorer_detect(struct psmouse *psmouse, bool set_properties) ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); param[0] = 80; ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); - ps2_command(ps2dev, param, PSMOUSE_CMD_GETID); + error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETID); + if (error) + return error; if (param[0] != 4) return -ENODEV; @@ -658,7 +667,7 @@ static int thinking_detect(struct psmouse *psmouse, bool set_properties) struct ps2dev *ps2dev = &psmouse->ps2dev; u8 param[2]; static const u8 seq[] = { 20, 60, 40, 20, 20, 60, 40, 20, 20 }; - int i; + int error, i; param[0] = 10; ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); @@ -668,7 +677,9 @@ static int thinking_detect(struct psmouse *psmouse, bool set_properties) param[0] = seq[i]; ps2_command(ps2dev, param, PSMOUSE_CMD_SETRATE); } - ps2_command(ps2dev, param, PSMOUSE_CMD_GETID); + error = ps2_command(ps2dev, param, PSMOUSE_CMD_GETID); + if (error) + return error; if (param[0] != 2) return -ENODEV; -- 2.34.0.rc2.393.gf8c9666880-goog