netdev - Re: [PATCH] ath9k_htc: fix uninit value bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <164242422410.16718.5618838300043178474.kvalo@kernel.org>
Date:   Mon, 17 Jan 2022 12:57:08 +0000 (UTC)
From:   Kalle Valo <kvalo@...nel.org>
To:     Pavel Skripkin <paskripkin@...il.com>
Cc:     ath9k-devel@....qualcomm.com, kvalo@...eaurora.org,
        davem@...emloft.net, kuba@...nel.org, linville@...driver.com,
        vasanth@...eros.com, Sujith.Manoharan@...eros.com,
        senthilkumar@...eros.com, linux-wireless@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        Pavel Skripkin <paskripkin@...il.com>,
        syzbot+f83a1df1ed4f67e8d8ad@...kaller.appspotmail.com
Subject: Re: [PATCH] ath9k_htc: fix uninit value bugs

Pavel Skripkin <paskripkin@...il.com> wrote:

> Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
> field initialization.
> 
> In htc_connect_service() svc_meta_len and pad are not initialized. Based
> on code it looks like in current skb there is no service data, so simply
> initialize svc_meta_len to 0.
> 
> htc_issue_send() does not initialize htc_frame_hdr::control array. Based
> on firmware code, it will initialize it by itself, so simply zero whole
> array to make KMSAN happy
> 
> Fail logs:
> 
> BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
>  hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
>  htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
>  htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
> ...
> 
> Uninit was created at:
>  slab_post_alloc_hook mm/slab.h:524 [inline]
>  slab_alloc_node mm/slub.c:3251 [inline]
>  __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
>  kmalloc_reserve net/core/skbuff.c:354 [inline]
>  __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
>  alloc_skb include/linux/skbuff.h:1126 [inline]
>  htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
> ...
> 
> Bytes 4-7 of 18 are uninitialized
> Memory access of size 18 starts at ffff888027377e00
> 
> BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
>  hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
>  htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
>  htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
> ...
> 
> Uninit was created at:
>  slab_post_alloc_hook mm/slab.h:524 [inline]
>  slab_alloc_node mm/slub.c:3251 [inline]
>  __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
>  kmalloc_reserve net/core/skbuff.c:354 [inline]
>  __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
>  alloc_skb include/linux/skbuff.h:1126 [inline]
>  htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
> ...
> 
> Bytes 16-17 of 18 are uninitialized
> Memory access of size 18 starts at ffff888027377e00
> 
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-by: syzbot+f83a1df1ed4f67e8d8ad@...kaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@...il.com>

How did you test this? As syzbot is mentioned I assume you did not test this on
a real device, it would help a lot if this is clearly mentioned in the commit
log. My trust on syzbot fixes is close to zero due to bad past history.

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20220115122733.11160-1-paskripkin@gmail.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches