netdev - Re: mt76: mt7921: add MCU support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 11 Feb 2021 09:55:22 +0100
From:   Lorenzo Bianconi <lorenzo@...nel.org>
To:     Colin Ian King <colin.king@...onical.com>
Cc:     Sean Wang <sean.wang@...iatek.com>,
        Soul Huang <Soul.Huang@...iatek.com>,
        Felix Fietkau <nbd@....name>,
        Lorenzo Bianconi <lorenzo.bianconi83@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "moderated list:ARM/Mediatek SoC support" 
        <linux-mediatek@...ts.infradead.org>
Subject: Re: mt76: mt7921: add MCU support

> Hi,
> 

Hi Colin,

a fix for this issue has been already posted upstream:

https://patchwork.kernel.org/project/linux-wireless/patch/857ff74f736d4e593f5ad602cee7ac67ebfca5ca.1612867656.git.lorenzo@kernel.org/

Regards,
Lorenzo

> Static analysis with Coverity on linux-next has found an issue with the
> following commit:
> 
> commit 1c099ab44727c8e42fe4de4d91b53cec3ef02860
> Author: Sean Wang <sean.wang@...iatek.com>
> Date:   Thu Jan 28 03:33:39 2021 +0800
> 
>     mt76: mt7921: add MCU support
> 
> The analysis is as follows:
> 
> 390 static void
> 391 mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
> 392                          u16 wlan_idx)
> 393 {
> 394        struct mt7921_mcu_wlan_info_event *wtbl_info =
> 395                (struct mt7921_mcu_wlan_info_event *)(skb->data);
> 396        struct rate_info rate = {};
> 397        u8 curr_idx = wtbl_info->rate_info.rate_idx;
> 398        u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]);
> 399        struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap;
> 400        struct mt76_phy *mphy = &dev->mphy;
> 
>    1. var_decl: Declaring variable stats without initializer.
> 
> 401        struct mt7921_sta_stats *stats;
> 402        struct mt7921_sta *msta;
> 403        struct mt76_wcid *wcid;
> 404
> 
>    2. Condition wlan_idx >= 288, taking false branch.
> 
> 405        if (wlan_idx >= MT76_N_WCIDS)
> 406                return;
> 
>    3. Condition 0 /* !((((sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof
> (char) || sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof (short)) ||
> sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof (int)) || sizeof
> ((*dev).mt76.wcid[wlan_idx]) == sizeof (long)) || sizeof
> ((*dev).mt76.wcid[wlan_idx]) == sizeof (long long)) */, taking false branch.
> 
>    4. Condition debug_lockdep_rcu_enabled(), taking true branch.
>    5. Condition !__warned, taking true branch.
>    6. Condition 0, taking false branch.
>    7. Condition rcu_read_lock_held(), taking false branch.
> 407        wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
>    8. Condition !wcid, taking true branch.
> 408        if (!wcid) {
> 
> Uninitialized pointer write (UNINIT)
>    9. uninit_use: Using uninitialized value stats.
> 
> 409                stats->tx_rate = rate;
> 410                return;
> 411        }
> 
> Line 409 dereferences pointer stats, however, this pointer has not yet
> been initialized.  The initialization occurs later:
> 
> 413        msta = container_of(wcid, struct mt7921_sta, wcid);
> 414        stats = &msta->stats;
> 
> Colin

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)