linux-kernel - Re: [PATCH] Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <66d9502e-682f-6ccd-ef90-138feee0c2ae@lwfinger.net>
Date:   Fri, 24 Jul 2020 12:56:22 -0500
From:   Larry Finger <Larry.Finger@...inger.net>
To:     Dinghao Liu <dinghao.liu@....edu.cn>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>, kjlu@....edu,
        Shreeya Patel <shreeya.patel23498@...il.com>,
        Julia Lawall <julia.lawall@...ia.fr>,
        Michael Straube <straube.linux@...il.com>,
        Stefano Brivio <sbrivio@...hat.com>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable
 authmode

On 7/24/20 8:28 AM, Dinghao Liu wrote:
> The variable authmode will keep uninitialized if neither if
> statements used to initialize this variable are not triggered.

Besides Greg's comment, you need to re-parse this sentence. I realize that 
English is probably not your first language, but this one is not what you meant.

You likely meant "The variable authmode will remain uninitialized if all 
statements used to initialize this variable are not triggered."

A possible (line-wrapped) patch to quiet the tools would be:

diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme.c 
b/drivers/staging/rtl8188eu/core/rtw_mlme.c
index 9de2d421f6b1..9e4d78bc9a2e 100644
--- a/drivers/staging/rtl8188eu/core/rtw_mlme.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme.c
@@ -1729,9 +1729,11 @@ int rtw_restruct_sec_ie(struct adapter *adapter, u8 
*in_ie, u8 *out_ie, uint in_
         if ((ndisauthmode == Ndis802_11AuthModeWPA) ||
             (ndisauthmode == Ndis802_11AuthModeWPAPSK))
                 authmode = _WPA_IE_ID_;
-       if ((ndisauthmode == Ndis802_11AuthModeWPA2) ||
-           (ndisauthmode == Ndis802_11AuthModeWPA2PSK))
+       else if ((ndisauthmode == Ndis802_11AuthModeWPA2) ||
+                (ndisauthmode == Ndis802_11AuthModeWPA2PSK))
                 authmode = _WPA2_IE_ID_;
+       else
+               authmode = 0;

         if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS)) {
                 memcpy(out_ie + ielength, psecuritypriv->wps_ie, 
psecuritypriv->wps_ie_len);


Yes, in this routine, it would be possible for authmode to not be set; however, 
later code only compares it to either _WPA_IE_ID_ or _WPA2_IE_ID_. It is never 
used in a way that an unset value could make the program flow be different by 
arbitrarily setting the value to zero. Thus your statement "Then authmode may 
contain a garbage value and influence the execution flow of this function." is 
false.

Larry