From: "Toke Høiland-Jørgensen" <toke@kernel.org>
To: Alexander Potapenko <glider@google.com>, glider@google.com
Cc: ath9k-devel@qca.qualcomm.com, davem@davemloft.net,
kuba@kernel.org, kvalo@codeaurora.org,
linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org,
syzbot+2ca247c2d60c7023de7f@syzkaller.appspotmail.com
Subject: Re: [PATCH] ath9k: fix an uninit value use in ath9k_htc_rx_msg()
Date: Fri, 07 Oct 2022 19:37:12 +0200 [thread overview]
Message-ID: <87leprcz7b.fsf@toke.dk> (raw)
In-Reply-To: <20220825080555.3643572-1-glider@google.com>
Alexander Potapenko <glider@google.com> writes:
> ath9k_htc_rx_msg() assumes skb->data contains a full
> `struct htc_frame_hdr`, thus it needs a call to pskb_may_pull()
> to ensure there is enough data.
>
> This fixes a long-standing issue reported by KMSAN:
>
> BUG: KMSAN: uninit-value in ath9k_htc_rx_msg+0x544/0x980 drivers/net/wireless/ath/ath9k/htc_hst.c:417
> ath9k_htc_rx_msg+0x544/0x980 drivers/net/wireless/ath/ath9k/htc_hst.c:417
> ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:653 [inline]
> ath9k_hif_usb_rx_cb+0x196a/0x1f10 drivers/net/wireless/ath/ath9k/hif_usb.c:686
> __usb_hcd_giveback_urb+0x522/0x740 drivers/usb/core/hcd.c:1670
> usb_hcd_giveback_urb+0x150/0x620 drivers/usb/core/hcd.c:1747
> dummy_timer+0xd3f/0x4f20 drivers/usb/gadget/udc/dummy_hcd.c:1988
> call_timer_fn+0x43/0x480 kernel/time/timer.c:1474
> expire_timers+0x272/0x610 kernel/time/timer.c:1519
> __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790
> ...
>
> Uninit was created at:
> ...
> __alloc_skb+0x34a/0xd70 net/core/skbuff.c:426
> __netdev_alloc_skb+0x126/0x780 net/core/skbuff.c:494
> __dev_alloc_skb include/linux/skbuff.h:3264 [inline]
> ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline]
> ath9k_hif_usb_rx_cb+0xe7b/0x1f10 drivers/net/wireless/ath/ath9k/hif_usb.c:686
> __usb_hcd_giveback_urb+0x522/0x740 drivers/usb/core/hcd.c:1670
> ...
>
> Reported-by: syzbot+2ca247c2d60c7023de7f@syzkaller.appspotmail.com
> Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
> Signed-off-by: Alexander Potapenko <glider@google.com>
This has been fixed (in a different way) by commit:
b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()")
-Toke
prev parent reply other threads:[~2022-10-07 17:37 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-25 8:05 [PATCH] ath9k: fix an uninit value use in ath9k_htc_rx_msg() Alexander Potapenko
2022-10-07 17:37 ` Toke Høiland-Jørgensen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87leprcz7b.fsf@toke.dk \
--to=toke@kernel.org \
--cc=ath9k-devel@qca.qualcomm.com \
--cc=davem@davemloft.net \
--cc=glider@google.com \
--cc=kuba@kernel.org \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+2ca247c2d60c7023de7f@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.