netdev - Re: Potential uninitialized variables in cfg80211

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <25d120fc154eb3da4185a3e82399cae97ba274f1.camel@sipsolutions.net>
Date:   Wed, 09 Oct 2019 08:45:28 +0200
From:   Johannes Berg <johannes@...solutions.net>
To:     Yizhuo Zhai <yzhai003@....edu>,
        "David S. Miller" <davem@...emloft.net>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: Potential uninitialized variables in cfg80211

On Tue, 2019-10-08 at 14:19 -0700, Yizhuo Zhai wrote:
> Hi All:
> net/wireless/chan.c:
> Inside function cfg80211_chandef_compatible(), variable "c1_pri40",
> " c2_pri40", "c1_pri80" and "c2_pri80" could be uninitialized if
> chandef_primary_freqs() fails. However, they are used later in the if
> statement to decide the control flow, which is potentially unsafe.

I guess theoretically this is right, but the function should only be
called with valid chandefs, and if chandef_primary_freqs() hit the
warning then the chandef certainly wasn't valid.

johannes