linux-kernel - Re: static analysis issue in rtl8188de driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1557129390.28660.4.camel@realtek.com>
Date:   Mon, 6 May 2019 07:56:30 +0000
From:   Pkshih <pkshih@...ltek.com>
To:     "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "colin.king@...onical.com" <colin.king@...onical.com>,
        "kvalo@...eaurora.org" <kvalo@...eaurora.org>,
        "Larry.Finger@...inger.net" <Larry.Finger@...inger.net>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: static analysis issue in rtl8188de driver

On Sat, 2019-05-04 at 21:50 +0000, Colin Ian King wrote:
> Hi,
> 
> Static analysis with Coverity has found an issue in the rtl8188de
> wireless driver in drivers/net/wireless/realtek/rtlwifi/rtl8192de/dm.c
> in function tl92d_dm_txpower_tracking_callback_thermalmeter.
> 
> The issue is that u8 array ofdm_index[3] is never initialized, however
> it is decremented and incremented in two places resulting in garbage
> value from the stack being updated in the following code:
> 
> 	if (thermalvalue > rtlpriv->dm.thermalvalue) {
>         	for (i = 0; i < rf; i++)
>                 	ofdm_index[i] -= delta;
>         	cck_index -= delta;
> 	} else {
>         	for (i = 0; i < rf; i++)
>                 	ofdm_index[i] += index;
>         	cck_index += index;	
> 	}
> 
> At my first look at the code I believe ofdm_index should be just
> zero-initialized at declaration time, but I suspect that I'm overlooking
> something maybe a bit deeper. Any ideas?
> 


Hi Colin,

Thanks for your report.

After my quick look, there are at least two obvious problems.
One is array size of ofdm_index[] should be two instead. Another is the value
of ofdm_index[] should be obtained from rtlpriv->dm.ofdm_index[]. 
Since the logic is quite complex, I need some time to fix it.

PK