From: Dan Carpenter <dan.carpenter@linaro.org>
To: Qianfeng Rong <rongqianfeng@vivo.com>
Cc: Brian Norris <briannorris@chromium.org>,
Francesco Dolcini <francesco@dolcini.it>,
Johannes Berg <johannes.berg@intel.com>,
Sascha Hauer <s.hauer@pengutronix.de>,
Kalle Valo <kvalo@kernel.org>,
Aditya Kumar Singh <quic_adisi@quicinc.com>,
Rameshkumar Sundaram <quic_ramess@quicinc.com>,
Roopni Devanathan <quic_rdevanat@quicinc.com>,
Jason Xing <kerneljasonxing@gmail.com>,
Jinjie Ruan <ruanjinjie@huawei.com>,
Bert Karwatzki <spasswolf@web.de>,
Jeff Chen <jeff.chen_1@nxp.con>,
Thomas Gleixner <tglx@linutronix.de>,
Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
"John W. Linville" <linville@tuxdriver.com>,
Cathy Luo <cluo@marvell.com>, Xinmin Hu <huxm@marvell.com>,
Avinash Patil <patila@marvell.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v3] wifi: mwifiex: Initialize the chan_stats array to zero
Date: Fri, 15 Aug 2025 08:23:13 +0300 [thread overview]
Message-ID: <aJ7EQZFT4rx2Tnj_@stanley.mountain> (raw)
In-Reply-To: <20250815023055.477719-1-rongqianfeng@vivo.com>
On Fri, Aug 15, 2025 at 10:30:50AM +0800, Qianfeng Rong wrote:
> The adapter->chan_stats[] array is initialized in
> mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out
> memory. The array is filled in mwifiex_update_chan_statistics()
> and then the user can query the data in mwifiex_cfg80211_dump_survey().
>
> There are two potential issues here. What if the user calls
> mwifiex_cfg80211_dump_survey() before the data has been filled in.
> Also the mwifiex_update_chan_statistics() function doesn't necessarily
> initialize the whole array. Since the array was not initialized at
> the start that could result in an information leak.
>
> Also this array is pretty small. It's a maximum of 900 bytes so it's
> more appropriate to use kcalloc() instead vmalloc().
>
> Cc: stable@vger.kernel.org
> Fixes: bf35443314ac ("mwifiex: channel statistics support for mwifiex")
> Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
> ---
Thanks so much!
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
regards,
dan carpenter
prev parent reply other threads:[~2025-08-15 5:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-15 2:30 [PATCH v3] wifi: mwifiex: Initialize the chan_stats array to zero Qianfeng Rong
2025-08-15 5:23 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aJ7EQZFT4rx2Tnj_@stanley.mountain \
--to=dan.carpenter@linaro.org \
--cc=briannorris@chromium.org \
--cc=christophe.jaillet@wanadoo.fr \
--cc=cluo@marvell.com \
--cc=francesco@dolcini.it \
--cc=huxm@marvell.com \
--cc=jeff.chen_1@nxp.con \
--cc=johannes.berg@intel.com \
--cc=kerneljasonxing@gmail.com \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=patila@marvell.com \
--cc=quic_adisi@quicinc.com \
--cc=quic_ramess@quicinc.com \
--cc=quic_rdevanat@quicinc.com \
--cc=rongqianfeng@vivo.com \
--cc=ruanjinjie@huawei.com \
--cc=s.hauer@pengutronix.de \
--cc=spasswolf@web.de \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox