[PATCH] netdev: zero out diagnostic info

[PATCH] netdev: zero out diagnostic info

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 1377 bytes --]

The info struct is on the stack which leads to the potential
for uninitialized data access. Zero out the info struct prior
to calling the get station callback:

==141137== Conditional jump or move depends on uninitialised value(s)
==141137==    at 0x458A6F: diagnostic_info_to_dict (diagnostic.c:109)
==141137==    by 0x41200B: station_get_diagnostic_cb (station.c:3620)
==141137==    by 0x405BE1: netdev_get_station_cb (netdev.c:4783)
==141137==    by 0x4722F9: process_unicast (genl.c:994)
==141137==    by 0x4722F9: received_data (genl.c:1102)
==141137==    by 0x46F28B: io_callback (io.c:120)
==141137==    by 0x46E5AC: l_main_iterate (main.c:478)
==141137==    by 0x46E65B: l_main_run (main.c:525)
==141137==    by 0x46E65B: l_main_run (main.c:507)
==141137==    by 0x46E86B: l_main_run_with_signal (main.c:647)
==141137==    by 0x403EA8: main (main.c:490)
---
 src/netdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/netdev.c b/src/netdev.c
index e9fa241f..ca38fa27 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -4759,6 +4759,8 @@ static void netdev_get_station_cb(struct l_genl_msg *msg, void *user_data)
 	if (!l_genl_attr_init(&attr, msg))
 		goto parse_error;
 
+	memset(&info, 0, sizeof(info));
+
 	while (l_genl_attr_next(&attr, &type, &len, &data)) {
 		switch (type) {
 		case NL80211_ATTR_STA_INFO:
-- 
2.26.2

Re: [PATCH] netdev: zero out diagnostic info

[Denis Kenzior]

[-- Attachment #1: Type: text/plain, Size: 1081 bytes --]

Hi James,

On 4/28/21 11:21 AM, James Prestwood wrote:
> The info struct is on the stack which leads to the potential
> for uninitialized data access. Zero out the info struct prior
> to calling the get station callback:
> 
> ==141137== Conditional jump or move depends on uninitialised value(s)
> ==141137==    at 0x458A6F: diagnostic_info_to_dict (diagnostic.c:109)
> ==141137==    by 0x41200B: station_get_diagnostic_cb (station.c:3620)
> ==141137==    by 0x405BE1: netdev_get_station_cb (netdev.c:4783)
> ==141137==    by 0x4722F9: process_unicast (genl.c:994)
> ==141137==    by 0x4722F9: received_data (genl.c:1102)
> ==141137==    by 0x46F28B: io_callback (io.c:120)
> ==141137==    by 0x46E5AC: l_main_iterate (main.c:478)
> ==141137==    by 0x46E65B: l_main_run (main.c:525)
> ==141137==    by 0x46E65B: l_main_run (main.c:507)
> ==141137==    by 0x46E86B: l_main_run_with_signal (main.c:647)
> ==141137==    by 0x403EA8: main (main.c:490)
> ---
>   src/netdev.c | 2 ++
>   1 file changed, 2 insertions(+)
> 

Applied, thanks.

Regards,
-Denis