linux-kernel - static analysis issue in rtl8188de driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a1842b3e-f0af-d1a1-8609-a76c25dfd37b@canonical.com>
Date:   Sat, 4 May 2019 22:50:43 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Ping-Ke Shih <pkshih@...ltek.com>,
        Kalle Valo <kvalo@...eaurora.org>,
        Larry Finger <Larry.Finger@...inger.net>,
        linux-wireless@...r.kernel.org
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: static analysis issue in rtl8188de driver

Hi,

Static analysis with Coverity has found an issue in the rtl8188de
wireless driver in drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c
in function tl92d_dm_txpower_tracking_callback_thermalmeter.

The issue is that u8 array ofdm_index[3] is never initialized, however
it is decremented and incremented in two places resulting in garbage
value from the stack being updated in the following code:

	if (thermalvalue > rtlpriv->dm.thermalvalue) {
        	for (i = 0; i < rf; i++)
                	ofdm_index[i] -= delta;
        	cck_index -= delta;
	} else {
        	for (i = 0; i < rf; i++)
                	ofdm_index[i] += index;
        	cck_index += index;	
	}

At my first look at the code I believe ofdm_index should be just
zero-initialized at declaration time, but I suspect that I'm overlooking
something maybe a bit deeper. Any ideas?

Colin