linux-kernel - Potential uninitialized variables in cfg80211

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 8 Oct 2019 14:19:23 -0700
From:   Yizhuo Zhai <yzhai003@....edu>
To:     Johannes Berg <johannes@...solutions.net>,
        "David S. Miller" <davem@...emloft.net>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Potential uninitialized variables in cfg80211

Hi All:
net/wireless/chan.c:
Inside function cfg80211_chandef_compatible(), variable "c1_pri40",
" c2_pri40", "c1_pri80" and "c2_pri80" could be uninitialized if
chandef_primary_freqs() fails. However, they are used later in the if
statement to decide the control flow, which is potentially unsafe.

The patch is hard since we do not know the correct value to initialize them.
-- 
Kind Regards,

Yizhuo Zhai

Computer Science, Graduate Student
University of California, Riverside