[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <164337315159.4876.15861801637015517784.kvalo@kernel.org>
Date: Fri, 28 Jan 2022 12:32:35 +0000 (UTC)
From: Kalle Valo <kvalo@...nel.org>
To: Pavel Skripkin <paskripkin@...il.com>
Cc: ath9k-devel@....qualcomm.com, kvalo@...eaurora.org,
davem@...emloft.net, kuba@...nel.org, linville@...driver.com,
vasanth@...eros.com, Sujith.Manoharan@...eros.com,
senthilkumar@...eros.com, linux-wireless@...r.kernel.org,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
Pavel Skripkin <paskripkin@...il.com>,
syzbot+f83a1df1ed4f67e8d8ad@...kaller.appspotmail.com
Subject: Re: [PATCH] ath9k_htc: fix uninit value bugs
Pavel Skripkin <paskripkin@...il.com> wrote:
> Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
> field initialization.
>
> In htc_connect_service() svc_meta_len and pad are not initialized. Based
> on code it looks like in current skb there is no service data, so simply
> initialize svc_meta_len to 0.
>
> htc_issue_send() does not initialize htc_frame_hdr::control array. Based
> on firmware code, it will initialize it by itself, so simply zero whole
> array to make KMSAN happy
>
> Fail logs:
>
> BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
> usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
> hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
> hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
> htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
> htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
> ...
>
> Uninit was created at:
> slab_post_alloc_hook mm/slab.h:524 [inline]
> slab_alloc_node mm/slub.c:3251 [inline]
> __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
> kmalloc_reserve net/core/skbuff.c:354 [inline]
> __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
> alloc_skb include/linux/skbuff.h:1126 [inline]
> htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
> ...
>
> Bytes 4-7 of 18 are uninitialized
> Memory access of size 18 starts at ffff888027377e00
>
> BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
> usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
> hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
> hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
> htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
> htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
> ...
>
> Uninit was created at:
> slab_post_alloc_hook mm/slab.h:524 [inline]
> slab_alloc_node mm/slub.c:3251 [inline]
> __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
> kmalloc_reserve net/core/skbuff.c:354 [inline]
> __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
> alloc_skb include/linux/skbuff.h:1126 [inline]
> htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
> ...
>
> Bytes 16-17 of 18 are uninitialized
> Memory access of size 18 starts at ffff888027377e00
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-by: syzbot+f83a1df1ed4f67e8d8ad@...kaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@...il.com>
> Signed-off-by: Kalle Valo <quic_kvalo@...cinc.com>
Patch applied to ath-next branch of ath.git, thanks.
d1e0df1c57bd ath9k_htc: fix uninit value bugs
--
https://patchwork.kernel.org/project/linux-wireless/patch/20220115122733.11160-1-paskripkin@gmail.com/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Powered by blists - more mailing lists