From: Chris Bainbridge <chris.bainbridge@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: johannes@sipsolutions.net, linux-wireless@vger.kernel.org,
aryabinin@virtuozzo.com
Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values
Date: Wed, 27 Jan 2016 15:46:18 +0000 [thread overview]
Message-ID: <20160127154618.GA5717@localhost> (raw)
In-Reply-To: <20160126111730.GA6765@localhost>
Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes:
[ 7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
[ 7.976608] load of value 2 is not a valid value for type '_Bool'
[ 7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
[ 7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015
[ 7.976616] Workqueue: phy0 rt2x00usb_work_rxdone
[ 7.976619] 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
[ 7.976622] ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
[ 7.976626] ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
[ 7.976629] Call Trace:
[ 7.976633] [<ffffffff8181d866>] dump_stack+0x45/0x5f
[ 7.976637] [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
[ 7.976642] [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
[ 7.976646] [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
[ 7.976650] [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
[ 7.976654] [<ffffffff81cb27ce>] ? usb_hcd_map_urb_for_dma+0x65e/0x960
[ 7.976659] [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
[ 7.976663] [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990
[ 7.976667] [<ffffffff81c5fb85>] rt2x00lib_rxdone+0x305/0xbd0
[ 7.976670] [<ffffffff811ac23f>] ? dequeue_task_fair+0x64f/0x1de0
[ 7.976674] [<ffffffff811a1516>] ? sched_clock_cpu+0xe6/0x150
[ 7.976678] [<ffffffff81c6c45c>] rt2x00usb_work_rxdone+0x7c/0x140
[ 7.976682] [<ffffffff8117aef6>] process_one_work+0x226/0x860
[ 7.976686] [<ffffffff8117b58c>] worker_thread+0x5c/0x680
[ 7.976690] [<ffffffff8117b530>] ? process_one_work+0x860/0x860
[ 7.976693] [<ffffffff81184f86>] kthread+0xf6/0x150
[ 7.976697] [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
[ 7.976700] [<ffffffff822a94df>] ret_from_fork+0x3f/0x70
[ 7.976703] [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
Link: https://lkml.org/lkml/2016/1/26/230
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
---
net/mac80211/agg-rx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 10ad4ac1fa0b..bde3344cbdd0 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -291,7 +291,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
}
/* prepare A-MPDU MLME for Rx aggregation */
- tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
+ tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
if (!tid_agg_rx)
goto end;
--
2.1.4
next prev parent reply other threads:[~2016-01-27 15:46 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-26 11:17 UBSAN: Undefined behaviour in net/mac80211/rx.c:924:18 Chris Bainbridge
2016-01-26 11:17 ` Chris Bainbridge
2016-01-27 15:46 ` Chris Bainbridge [this message]
2016-01-27 23:27 ` [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values Julian Calaby
2016-01-27 23:27 ` Julian Calaby
2016-01-28 9:48 ` Johannes Berg
2016-01-28 9:48 ` Johannes Berg
2016-01-28 10:11 ` Julian Calaby
2016-01-28 10:11 ` Julian Calaby
2016-01-28 10:24 ` Julia Lawall
2016-01-28 10:24 ` Julia Lawall
2016-01-28 12:30 ` Dan Carpenter
2016-01-28 12:30 ` Dan Carpenter
2016-01-28 12:35 ` Johannes Berg
2016-01-28 12:35 ` Johannes Berg
2016-01-28 9:47 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160127154618.GA5717@localhost \
--to=chris.bainbridge@gmail.com \
--cc=aryabinin@virtuozzo.com \
--cc=johannes@sipsolutions.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.