DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2344

Unchecked register read uses uninitialized stack for port-count decision in attach

Summary

In umcs7840_attach return value of umcs7840_get_reg_sync(sc MCS7840_DEV_REG_GPIO &data) at :324 is discarded. On USB control-transfer failure local uint8_t data declared at :301 remains uninitialized and read at :325 to choose 2- vs 4-port configuration. Next register read at :339 correctly checks return value - only GPIO read omits check. No memory-safety impact: decision only sets sc_numports 2 or 4 portno hardcoded within UMCS7840_MAX_PORTS. Worst: wrong port count causes attach failure.

Discussion (0)

No comments yet.